CVE-2022-23459CWE-415CWE-416

Double free or Use after Free in Value class of Jsonxx

High · published August 19, 2022

CVSS v3.1
8.1
EPSS
1%
Percentile
61.5
In the wild
Unconfirmed
What it is

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a double free or via a use after free. The value class has a default assignment operator which may be used with pointer types which may point to alterable data where the pointer itself is not updated. This issue exists on the current commit of the jsonxx project. The project itself has been archived and updates are not expected. Users are advised to find a replacement.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00968 · 61.5th percentile
Weaknesses
CWE-415 · Double Free; CWE-416 · Use After Free
Published
2022-08-19T19:00Z
EPSS history
Timeline
  • 19 AUG 19:00Z
    Double free or Use after Free in Value class of Jsonxx
    cvelistv5