CVE-2020-12762

HighCVSS 7.8

Published: 09/05/2020(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.90%

79th percentile - higher than 79% of all known CVEs

Summary

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. This can lead to memory corruption.

Risk Assessment

The vulnerability may allow an attacker to corrupt memory, threatening application stability and potentially enabling code execution. The risk occurs when processing large, untrusted JSON files.

Recommendation

Upgrade json-c to a version newer than 0.14 and avoid processing untrusted, large JSON files.

Other vulnerabilities in json-c

CVE-2021-32292Critical
An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse, located in the function parseit. This may lead to memory corruption when processing input data.

Original NVD description (English source)

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS