External risk intelligence

cJSON Remote Out-of-Bounds Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-57052

cJSON is a widely used C library for parsing JSON data. Because it is a library integrated into various applications rather than a standalone network service, its exposure depends entirely on the implementation of the host application. While it can process untrusted data from network-facing interfaces, the vulnerability is not inherently bound to a public-facing service by default.

Out-of-bounds Read

Davegamble Cjson

1.5.0 to 1.7.18

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the cJSON library, a common tool for handling JSON data. The issue allows for out-of-bounds memory access, which could potentially lead to the exposure or manipulation of restricted data if exploited through malformed inputs. The main concern is to confirm if this library is used within your organization and if it processes untrusted data.

Flaw lets attackers read/write outside memory.
Widely used library, indirect impact.
Confirm use and exposure of library.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending specially crafted JSON pointer strings. These strings, when processed by the `decode_array_index_from_pointer` function, can cause the program to access memory outside of its intended bounds. This bypasses security checks and can lead to unauthorized data access or modification.

No authentication or user interaction needed.
Triggered by malformed JSON pointer strings.
Risk of unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow remote attackers to bypass array bounds checking in the `decode_array_index_from_pointer` function, potentially leading to access of restricted data via specially crafted JSON pointer strings.

Array bounds checking could be bypassed.
Malformed JSON pointer strings may cause exposure.
Restricted data access could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in cJSON affects applications that parse JSON data, particularly those processing untrusted input. Ownership will likely fall to the application development team or platform team responsible for the software integrating cJSON. The first practical step is to identify all applications utilizing the affected cJSON versions, confirm if they handle external JSON input, and then determine their business criticality to prioritize remediation efforts.

Application teams own this issue.
Verify external JSON input processing.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the cJSON library?

cJSON is a lightweight, widely used C library designed to parse and generate JSON data. Developers integrate it into various software applications to handle data exchange, often within embedded systems, IoT devices, or network-enabled services where efficient, low-level data processing is required.

How does CVE-2025-57052 trigger out-of-bounds access?

This vulnerability involves a weakness categorized as CWE-125 (Out-of-bounds Read) and CWE-129 (Improper Validation of Array Index). It occurs when the library's pointer decoding function fails to correctly verify array bounds, allowing specially crafted, malformed JSON pointer strings to access memory addresses outside the intended data structure.

Do malformed JSON strings always cause a crash?

No. The vulnerability is specific to malformed JSON pointer strings containing certain alphanumeric characters processed by a particular function. Standard JSON data or pointer strings that do not attempt to navigate outside defined array boundaries will not trigger this specific out-of-bounds memory access.

How do I know if my system is at risk?

According to Halo Surface Signal, because cJSON is a library rather than a standalone service, your risk depends on whether your host application uses a vulnerable version (1.5.0–1.7.18) to process untrusted data. Systems that parse external JSON inputs from network-facing interfaces are more likely to be exposed than those processing only trusted or local data.

What is the first step to address this CVE?

Begin by auditing your software inventory to identify which applications include the affected cJSON versions. Once identified, evaluate whether these applications parse untrusted external data. If they do, coordinate with the responsible development teams to prioritize updating the library to a patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.