CVE-2019-11834 cJSON before 1.7.11 allows out-of-bounds access related to \x00 in a string literal.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Discovered in cJSON Leading to Out-of-Bounds Access Vulnerabilities Two vulnerabilities in cJSON have been reported, affecting versions 1.5.0 through 1.7.18 and earlier than 1.7.11. CVE-2019-11834 allows out-of-bounds access related to null characters in string literals, while CVE-2025-57052 enables remote attackers to bypass array bounds checking via malformed JSON pointer strings. Both vulnerabilities pose risks to applications utilizing affected cJSON versions. 2 sources 39