Integer overflow in JSON-XS - CVE-2025-40928

Vulnerability identifier: #VU115180

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-40928

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an integer overflow when parsing JSON data. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

JSON-XS
Debian Linux
Anolis OS
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
openEuler
Ubuntu
Fedora
Juniper Secure Analytics (JSA)
IBM Qradar SIEM
perl-JSON-XS
perl-JSON-XS (Red Hat package)
perl-JSON-XS-debuginfo
perl-JSON-XS-debugsource
perl-JSON-XS-help
libjson-xs-perl (Ubuntu package)
libjson-xs-perl (Debian package)

Install updates from vendor's website.

JSON-XS - update to 4.04
Juniper Secure Analytics (JSA) - update to 7.5.0 UP14 IF01
IBM Qradar SIEM - update to 7.5.0 Update Pack 14 IF01
perl-JSON-XS - update to 3.04-4
perl-JSON-XS (Red Hat package) - addressed in versions 3.04-4.el8_10, 4.03-5.el9_4.1, 4.04-1.el9_6, 4.04-1.el10_0
perl-JSON-XS - addressed in versions 3.04-7, 4.03-2
perl-JSON-XS-debuginfo - addressed in versions 3.04-7, 4.03-2
perl-JSON-XS-debugsource - addressed in versions 3.04-7, 4.03-2
perl-JSON-XS-help - addressed in versions 3.04-7, 4.03-2
perl-JSON-XS - addressed in versions 4.04-1.fc41, 4.04-1.fc42, 4.04-1.fc43
libjson-xs-perl (Ubuntu package) - addressed in versions 4.040-0ubuntu0.22.04.1, 4.040-0ubuntu0.24.04.1, 4.040-0ubuntu0.25.04.1
libjson-xs-perl (Debian package) - addressed in versions 4.040-1~deb12u1, 4.040-1~deb13u1

• https://metacpan.org/release/MLEHMANN/JSON-XS-4.03/source/XS.xs#L256
• https://security.metacpan.org/patches/J/JSON-XS/4.03/CVE-2025-40928-r1.patch

• Remote code execution in JSON::XS for Perl
• Debian update for libjson-xs-perl
• Fedora 43 update for perl-JSON-XS
• Fedora 42 update for perl-JSON-XS
• Fedora 41 update for perl-JSON-XS
• Ubuntu update for libjson-xs-perl
• Red Hat Enterprise Linux 10 update for perl-JSON-XS
• Anolis OS update for perl-JSON-XS
• openEuler 24.03 LTS SP2 update for perl-JSON-XS
• openEuler 24.03 LTS update for perl-JSON-XS
• openEuler 20.03 LTS SP4 update for perl-JSON-XS
• Red Hat Enterprise Linux 9 update for perl-JSON-XS
• Red Hat Enterprise Linux 8 update for perl-JSON-XS
• Red Hat Enterprise Linux 9 update for perl-JSON-XS
• openEuler 22.03 LTS SP3 update for perl-JSON-XS
• openEuler 24.03 LTS SP1 update for perl-JSON-XS
• openEuler 22.03 LTS SP4 update for perl-JSON-XS
• Multiple vulnerabilities in IBM QRadar SIEM
• Juniper Secure Analytics update for third-party components