CVE-2025-57052

What it actually does

Out-of-bounds memory access in decode_array_index_from_pointer within cJSON_Utils.c permits bypassing array bounds checks via crafted JSON pointer strings containing alphanumeric characters, enabling unauthorized data reads from adjacent memory regions.

Why it matters to the business

Attackers may extract sensitive data from applications using affected cJSON versions, leading to information disclosure risks that could expose internal structures or confidential payloads without authentication.

How an attack unfolds

An attacker crafts a malformed JSON pointer string embedding alphanumeric sequences and supplies it to an application parsing JSON via cJSON utilities; the decode_array_index_from_pointer function fails to validate the index, resulting in out-of-bounds reads that leak restricted memory contents.

How to fix it

Upgrade cJSON to a patched release beyond version 1.7.18; recompile and redeploy all dependent applications after verifying the library update.

How to confirm the fix worked

Confirm the installed cJSON version is newer than 1.7.18 via package manifests or build outputs; test parsing of sample malformed JSON pointers to ensure bounds checks now prevent access.

Typical attack path

1. Identify an application endpoint or API that accepts JSON input containing JSON pointer references
2. Craft a pointer string with unexpected alphanumeric characters to target array decoding logic
3. Submit the malformed JSON to trigger decode_array_index_from_pointer
4. Observe or exfiltrate data returned from out-of-bounds memory locations

How to detect it

Review application logs for JSON pointer strings containing unexpected alphanumeric sequences; inspect memory dumps or crash reports referencing decode_array_index_from_pointer for signs of abnormal access patterns.

• decode_array_index_from_pointer
• malformed JSON pointer with alphanumeric characters

What your security team should do

• Inventory all software using cJSON 1.5.0-1.7.18 and prioritize upgrades based on exposure
• Implement input validation or sanitization for JSON pointer fields until patches are applied
• Monitor EPSS and threat intelligence feeds for any increase in exploitation activity