External risk intelligence

json-c Stack Buffer Overflow in Sample Program

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2021-32292

The vulnerability exists in an auxiliary sample program (json_parse) within the json-c library. Sample code and auxiliary utilities are typically used for development, testing, or educational purposes and are not intended for, nor typically present in, production deployments of internet-facing services.

Out-of-bounds Write

Netapp Active Iq Unified Manager

0.15-20200726

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical vulnerability in the json-c software library that could allow an attacker to impact system operations. The issue lies within a sample program used for parsing data, and while its potential for exploitation in production environments is considered very unlikely, its high severity warrants confirmation of relevance and exposure.

A library used for processing data has a critical flaw.
It's in auxiliary code, unlikely to be in production.
Confirm relevance and exposure to be certain.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending specially crafted JSON data to a program that uses the vulnerable `json-c` library. This could lead to the program crashing or being taken over by the attacker.

Entry Condition: Network access to a vulnerable application.
Trigger Point: Processing malicious JSON input.
Resulting Risk: Complete compromise of the system.

Live Threat

Current exploitation, exposure, and threat context

A stack-buffer-overflow in an auxiliary program of the json-c library could potentially be triggered when processing malformed JSON data. This vulnerability exists in the `json_parse` program, which is part of the library's sample code.

Auxiliary program data could be affected.
Malformed JSON input could cause a crash.
Denial of service is a potential consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the `json-c` library affects the auxiliary sample program `json_parse`. Ownership likely resides with teams managing development tools, custom applications using `json-c`, or potentially those responsible for third-party library integration. The first practical step is to determine if this specific sample program is deployed in any production or accessible environments, identify the accountable owner for that deployment, and then prioritize remediation based on confirmed exposure and criticality.

Identify accountable application or library owners.
Verify if the auxiliary sample program is deployed.
Plan remediation based on verified risk exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is json-c and why does it have a security advisory?

json-c is a library used by developers to parse and generate JSON data within software applications. It is often integrated into other systems, such as NetApp Active IQ Unified Manager, to handle data communication. This advisory was issued because a specific auxiliary sample program included with the library code contains a memory safety defect that could be misused.

What does the stack-buffer-overflow in CVE-2021-32292 mean?

This vulnerability is classified as CWE-787, which is an out-of-bounds write. It occurs when a program tries to store more data in a temporary memory space, called the stack, than it can hold. In the context of CVE-2021-32292, processing malformed input can cause the program to overwrite adjacent memory, potentially leading to system instability or allowing an attacker to take control of the application.

How is the json_parse program triggered?

The vulnerability is triggered when the specific json_parse utility is executed and processes specially crafted, malicious JSON input. It is important to note that simply using the main json-c library for standard JSON parsing in your own applications does not necessarily trigger this bug; the flaw is contained within the auxiliary sample code provided with the library.

Do I need to worry about this if my systems are internet-facing?

According to Halo Surface Signal, it is very unlikely that you are at risk. Because this flaw exists only in an auxiliary sample program—not the core library code used in production—these utilities are rarely present in live, internet-facing environments. You should focus your attention on verifying whether this specific sample utility was inadvertently included in your production deployments.

How should I respond if I find json-c in my environment?

First, confirm if the vulnerable json_parse utility is actually present on your systems. Since this is a sample tool, it is not required for standard application functionality. If you locate the utility, determine which team manages that software deployment and remove the sample program to eliminate the risk. Always verify your inventory before taking action to ensure you are targeting the specific component mentioned.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.