CVE-2025-57052

NameCVE-2025-57052
DescriptioncJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4304-1, DSA-6001-1
Debian Bugs1114757

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cjson (PTS)bookworm, bookworm (security)1.7.15-1+deb12u4fixed
trixie (security), trixie1.7.18-3.1+deb13u1fixed
forky, sid1.7.19-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cjsonsourcebullseye1.7.14-1+deb11u3DLA-4304-1
cjsonsourcebookworm1.7.15-1+deb12u4DSA-6001-1
cjsonsourcetrixie1.7.18-3.1+deb13u1DSA-6001-1
cjsonsource(unstable)1.7.19-11114757

Notes

https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa4139126967f6d289b675b4b36fef (v1.7.19)
Search for package or bug name: Reporting problems