CVE-2025-57052: Critical JSON Parsing Flaw in cJSON With CVSS 9.8, PoC Available

CVE-2025-57052 is described as a critical JSON parsing flaw in the cJSON library, tracked with CVSS 9.8 and with a PoC available, disclosed by security researcher Salah Chafai. The issue lies in the decode_array_index_from_pointer function within cJSON_Utils.c, where the loop checks pointer[0] instead of pointer[position], allowing non-digit characters to be processed as part of the array index.

According to the report, this can lead to out-of-bounds memory access, including segmentation faults, and may enable privilege escalation or denial of service in affected software. The demonstration uses a crafted index such as 0A, which causes cJSON to access element 10 in an array of three elements, illustrating the potential for crashes and memory access beyond intended limits.

Because cJSON is embedded in numerous projects, the vulnerability affects a broad range of software, including Web APIs, embedded/IoT devices, and desktop or server applications relying on JSON pointers. The fix is straightforward: correct the loop condition, changing pointer[0] to pointer[position] in the vulnerable code.