yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)
References
Configurations
History
17 Sep 2025, 20:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh - Exploit, Vendor Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2/ - Mailing List | |
| CPE | cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* cpe:2.3:a:ibireme:yyjson:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
|
| First Time |
Ibireme yyjson
Fedoraproject Fedoraproject fedora Ibireme |
Information
Published : 2024-02-29 01:44
Updated : 2025-09-17 20:29
NVD link : CVE-2024-25713
Mitre link : CVE-2024-25713
CVE.ORG link : CVE-2024-25713
JSON object : View
Products Affected
fedoraproject
- fedora
ibireme
- yyjson
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')