Out-of-bounds read in cJSON - CVE-2025-57052

Vulnerability identifier: #VU115011

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-57052

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the decode_array_index_from_pointer() function in cJSON_Utils.c. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.

cJSON
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Workstation Extension 15
Red Hat Enterprise Linux for x86_64
Fedora
openEuler
cjson (Debian package)
cjson-devel
cjson-debugsource
cjson-debuginfo
cjson
cjson (Red Hat package)
libcjson1-debuginfo
cJSON-debugsource
libcjson1
rubygem-smart_proxy_ansible (Red Hat package)
foreman-installer (Red Hat package)
foreman (Red Hat package)
python-django (Red Hat package)
rubygem-katello (Red Hat package)
satellite (Red Hat package)
rubygem-kafo (Red Hat package)
puppet-agent (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)
Red Hat Satellite

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

cjson (Debian package) - addressed in versions 1.7.15-1+deb12u4, 1.7.18-3.1+deb13u1
cjson-devel - addressed in versions 1.7.15-7, 1.7.15-11
cjson-debugsource - addressed in versions 1.7.15-7, 1.7.15-11
cjson-debuginfo - addressed in versions 1.7.15-7, 1.7.15-11
cjson - addressed in versions 1.7.15-7, 1.7.15-11
cjson (Red Hat package) - addressed in versions 1.7.18-2.el8sat, 1.7.18-2.el9sat
cjson - addressed in versions 1.7.19-1.el10_3, 1.7.19-1.fc44
libcjson1-debuginfo - update to 1.7.19-150700.3.3.1
cJSON-debugsource - update to 1.7.19-150700.3.3.1
libcjson1 - update to 1.7.19-150700.3.3.1
rubygem-smart_proxy_ansible (Red Hat package) - addressed in versions 3.5.6.1-1.el8sat, 3.5.6.1-1.el9sat
foreman-installer (Red Hat package) - addressed in versions 3.12.0.6-1.el8sat, 3.12.0.6-1.el9sat, 3.14.0.7-1.el9sat
foreman (Red Hat package) - update to 3.14.0.8-1.el9sat
python-django (Red Hat package) - addressed in versions 4.2.24-0.1.el8pc, 4.2.24-0.1.el9pc
rubygem-katello (Red Hat package) - addressed in versions 4.14.0.14-1.el8sat, 4.14.0.14-1.el9sat
Red Hat Satellite - addressed in versions 6.15.5.5, 6.16.5.4, 6.17.5
satellite (Red Hat package) - addressed in versions 6.15.5.5-1.el8sat, 6.16.5.4-1.el8sat, 6.16.5.4-1.el9sat, 6.17.5-1.el9sat
rubygem-kafo (Red Hat package) - addressed in versions 7.4.0.1-1.el8sat, 7.4.0.1-1.el9sat
puppet-agent (Red Hat package) - addressed in versions 7.34.0-4.el8sat, 8.8.1-3.el8sat, 8.8.1-3.el9sat
rubygem-foreman_bootdisk (Red Hat package) - update to 22.0.4-1.el9sat

• https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability

• Out-of-bounds read in cJSON
• Debian update for cjson
• SUSE update for cJSON
• openEuler 24.03 LTS SP2 update for cjson
• openEuler 24.03 LTS update for cjson
• openEuler 22.03 LTS SP4 update for cjson
• openEuler 22.03 LTS SP3 update for cjson
• openEuler 24.03 LTS SP1 update for cjson
• Multiple vulnerabilities in Red Hat Satellite 6.17
• Multiple vulnerabilities in Red Hat Satellite 6.16
• Multiple vulnerabilities in Red Hat Satellite 6.15
• Fedora 44 update for cjson
• Fedora EPEL 10.3 update for cjson