CVE-2025-57052: 
NixOS vulnerability analysis and mitigation

CVE-2025-57052 is an out-of-bounds access vulnerability in the cJSON library affecting versions 1.5.0 through 1.7.18. The flaw resides in the decode_array_index_from_pointer function within cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted memory via malformed JSON pointer strings containing alphanumeric characters. It was publicly disclosed on September 3, 2025, and carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-129 (Improper Validation of Array Index). The decode_array_index_from_pointer function in cJSON_Utils.c fails to properly validate array indices derived from JSON pointer strings, allowing an attacker to supply crafted alphanumeric characters in a JSON pointer that bypass bounds checks and cause the library to read (or potentially write) outside the intended memory region. Exploitation requires no authentication and no user interaction — an attacker need only supply a malformed JSON pointer string to an application that processes it using the vulnerable cJSON library. A technical write-up and proof-of-concept are publicly available (x-0r PoC).

Successful exploitation can result in unauthorized access to restricted memory, potential disclosure of sensitive data, memory corruption, and in the worst case, arbitrary code execution or application crashes. The vulnerability affects confidentiality, integrity, and availability at a high level, as an attacker could read out-of-bounds memory, corrupt data structures, or destabilize the host application. Given cJSON's widespread use as an embedded C JSON library across IoT devices, network appliances, and server-side applications, the blast radius is broad and may facilitate lateral movement in environments where the library processes untrusted network input (Red Hat Advisory, x-0r PoC).

A proof-of-concept exploit is publicly available at x-0r.com, though there is no confirmed evidence of active in-the-wild exploitation at this time (x-0r PoC). The vulnerability requires no privileges and no user interaction, making it trivially exploitable by remote unauthenticated attackers against any application that exposes cJSON's JSON pointer functionality to external input. The EPSS score is approximately 0.087%, indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability has been acknowledged by Microsoft and is detectable by Nessus and Qualys scanners (Microsoft MSRC, Red Hat Bugzilla). It is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify applications or services that use the cJSON library (versions 1.5.0–1.7.18) and accept JSON pointer strings as input — common in IoT firmware, REST APIs, and embedded systems.
2. Craft malicious JSON pointer: Construct a malformed JSON pointer string containing alphanumeric characters designed to produce an out-of-bounds array index when parsed by decode_array_index_from_pointer in cJSON_Utils.c.
3. Submit payload: Send the crafted JSON pointer string to the target application via any network-accessible interface that passes the pointer to the vulnerable cJSON function (e.g., HTTP request body, MQTT message, or other protocol input).
4. Trigger out-of-bounds access: The vulnerable function fails to validate the derived array index, causing the library to access memory outside the intended array boundaries.
5. Achieve objective: Depending on memory layout and application context, the attacker may read sensitive data from adjacent memory, corrupt data structures, or trigger a crash — potentially escalating to code execution in favorable conditions (x-0r PoC).

• Network: Unusual or malformed JSON pointer strings (e.g., containing unexpected alphanumeric sequences in array index positions) in HTTP request bodies or other protocol payloads directed at services using cJSON.
• Logs: Application crash logs or segmentation fault reports originating from cJSON_Utils.c or the decode_array_index_from_pointer function; unexpected process restarts of services that use cJSON.
• Process: Abnormal memory access violations or core dumps generated by applications linked against cJSON 1.5.0–1.7.18; unexpected child processes spawned by cJSON-consuming services.
• File System: Presence of cJSON library versions 1.5.0–1.7.18 (libcjson.so, cJSON_Utils.c build artifacts) on systems that have not been patched.

Upgrade the cJSON library to a version beyond 1.7.18 as the primary remediation. Red Hat has issued patches for affected products including Red Hat Satellite 6.15 (RHSA-2025:17614), 6.16 (RHSA-2025:17613), and 6.17 (RHSA-2025:17606). Debian, SUSE, Ubuntu, and openSUSE have also released updated packages for their respective distributions. As an interim workaround, implement strict input validation for JSON pointer strings at the application layer before passing them to cJSON, and consider restricting network access to systems running vulnerable versions until patching is complete (Red Hat Bugzilla, Red Hat Advisory).

Red Hat triaged the vulnerability at high severity and issued multiple errata for Red Hat Satellite products within approximately five weeks of disclosure. Microsoft acknowledged the vulnerability in its September 2025 Patch Tuesday update guide. Rapid7 included CVE-2025-57052 in its September 2025 Patch Tuesday analysis. Community discussion has been observed on Bluesky and Reddit (notably in the Fortinet community regarding FortiClientEMS), reflecting broad concern about the library's wide deployment footprint (Rapid7 Blog, Microsoft MSRC).