CVE-2021-32292

CriticalCVSS 9.8

Published: 22/08/2023(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.29%

70th percentile - higher than 70% of all known CVEs

Summary

An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse, located in the function parseit. This may lead to memory corruption when processing input data.

Risk Assessment

The vulnerability can be exploited by supplying specially crafted data to the json_parse program, potentially causing a crash or possible code execution. It affects environments using vulnerable versions of json-c and the json_parse program.

Recommendation

Update the json-c library to a version later than 0.15-20200726 or apply vendor patches. Avoid using the auxiliary json_parse program on untrusted input data.

Other vulnerabilities in json-c

CVE-2020-12762High
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. This can lead to memory corruption.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS