Critical severity9.8NVD Advisory· Published Sep 3, 2025· Updated Jun 17, 2026

CVE-2025-57052

Description

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Davegamble/cjson/Cjson
cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*
Range: >=1.5.0,<=1.7.18
cJSON/cJSONdescription
CJSON/cJSONllm-fuzzy
Range: 1.5.0 - 1.7.18
osv-coords3 versions
pkg:rpm/opensuse/cJSON&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/cJSON&distro=openSUSE%20Tumbleweed pkg:rpm/suse/cJSON&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7
< 1.7.19-160000.1.1+ 2 more
- (no CPE)range: < 1.7.19-160000.1.1
- (no CPE)range: < 1.7.19-1.1
- (no CPE)range: < 1.7.19-150700.3.3.1

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2025-57052

Description

AI Insight

Affected products

Patches

Vulnerability mechanics

References

News mentions