Login Request a demo
Critical severity · published Aug 20, 2018
CVE-2018-1000217
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE. This attack appear to be exploitable via Depends on how application uses cJSON library. If application provides network interface then can be exploited over a network, otherwise just local.. This vulnerability appears to have been fixed in 1.7.4.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CJ
Cjson · Davegamble
before 1.7.4 · source: NVD
Affected product
CJ
Cjson
Davegamble
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000217
Exploit
https://github.com/DaveGamble/cJSON/issues/248
More from Cjson
9.8
CVE-2025-57052
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking…
9.8
CVE-2019-11835
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments
9.8
CVE-2019-11834
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal
9.8
CVE-2016-10749
parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character
8.8
CVE-2018-1000216
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE