CVE-2025-57052 cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Discovered in cJSON Leading to Out-of-Bounds Access Vulnerabilities Two vulnerabilities in cJSON have been reported, affecting versions 1.5.0 through 1.7.18 and earlier than 1.7.11. CVE-2019-11834 allows out-of-bounds access related to null characters in string literals, while CVE-2025-57052 enables remote attackers to bypass array bounds checking via malformed JSON pointer strings. Both vulnerabilities pose risks to applications utilizing affected cJSON versions. 2 sources 39

Extracted Entities

Attack Types (1)

CVEs (1)