PT-2025-35723 · Cjson+5 · Cjson+5

X-0R · Published 2025-09-03 · Updated 2026-03-11 · CVE-2025-57052

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cJSON versions 1.5.0 through 1.7.18

Description cJSON versions 1.5.0 through 1.7.18 contain an out-of-bounds access issue within the decode array index from pointer function located in cJSON Utils.c. This allows attackers to bypass array bounds checking and potentially access restricted data by providing malformed JSON pointer strings that include alphanumeric characters.

Recommendations Update cJSON to a version later than 1.7.18.

Exploit

Fix

RCE

Out of bounds Read

Improper Validation of Array Index

Weakness Enumeration

CWE-125

CWE-129

Related Identifiers

ALT-PU-2025-12379

ALT-PU-2025-12381

BDU:2025-12591

CVE-2025-57052

DLA-4304-1

DSA-6001-1

OESA-2025-2374

OESA-2025-2375

OESA-2025-2376

OESA-2025-2377

OESA-2025-2491

OPENSUSE-SU-2025:15583-1

OPENSUSE-SU-2026:20340-1

RHSA-2025:17614

SUSE-SU-2025:03520-1

USN-7973-1

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Ubuntu

Cjson

References · 55

• 🔥 https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability · Exploit
• https://osv.dev/vulnerability/DSA-6001-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7973-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26819 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-57052 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7973-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57052 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-53154 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2377 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-57052 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-57052 · Security Note
• https://bdu.fstec.ru/vul/2025-12591 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2376 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-57052 · Vendor Advisory