PT-2025-35723 · Cjson+5 · Cjson+5

X-0R · CVE-2025-57052 · Published 2025-09-03 · Updated 2026-03-11

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cJSON versions 1.5.0 through 1.7.18

Description cJSON versions 1.5.0 through 1.7.18 contain an out-of-bounds access issue within the decode array index from pointer function located in cJSON Utils.c. This allows attackers to bypass array bounds checking and potentially access restricted data by providing malformed JSON pointer strings that include alphanumeric characters.

Recommendations Update cJSON to a version later than 1.7.18.

Exploit

Fix

DoS

RCE

Improper Validation of Array Index

Out of bounds Read

Weakness Enumeration

CWE-129

CWE-125

Related Identifiers

ALT-PU-2025-12379

ALT-PU-2025-12381

BDU:2025-12591

CVE-2025-57052

DLA-4304-1

DSA-6001-1

OESA-2025-2374

OESA-2025-2375

OESA-2025-2376

OESA-2025-2377

OESA-2025-2491

OPENSUSE-SU-2025:15583-1

OPENSUSE-SU-2026:20340-1

RHSA-2025:17614

SUSE-SU-2025:03520-1

USN-7973-1

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Ubuntu

Cjson

References · 56

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57052.json · Exploit
• 🔥 https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57052 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20340-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03520-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15583-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7973-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7973-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2374 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4304-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-57052 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-57052 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2375 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2377 · Vendor Advisory