CVE-2024-25713

2024-02-2901:44:16

Debian Security Bug Tracker

security-tracker.debian.org

yyjson remote code execution pool allocator

7.8 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)

OSVersionArchitecturePackageVersionFilename
Debian999allyyjson< 0.9.0+ds-2yyjson_0.9.0+ds-2_all.deb
Debian13allyyjson< 0.9.0+ds-2yyjson_0.9.0+ds-2_all.deb