GHSA-9H69-JRQQ-936C

Vulnerability from github – Published: 2023-09-25 18:30 – Updated: 2025-11-04 21:30

Details

A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. An attacker can deliver file to trigger this vulnerability.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-39453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-25T16:15:14Z",
    "severity": "CRITICAL"
  },
  "details": "A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. An attacker can deliver file to trigger this vulnerability.",
  "id": "GHSA-9h69-jrqq-936c",
  "modified": "2025-11-04T21:30:39Z",
  "published": "2023-09-25T18:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39453"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1830"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1830"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9H6G-G22R-WGHG

Vulnerability from github – Published: 2022-02-19 00:00 – Updated: 2022-03-01 00:00

Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15104.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-24062"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-18T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15104.",
  "id": "GHSA-9h6g-g22r-wghg",
  "modified": "2022-03-01T00:00:49Z",
  "published": "2022-02-19T00:00:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24062"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-254"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-9H8H-JWRX-HXGG

Vulnerability from github – Published: 2023-10-11 21:33 – Updated: 2023-10-11 21:33

Details

Use After Free in GitHub repository vim/vim prior to v9.0.2010.

Severity

7.8 (High)


                  
                    CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-5535"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-11T20:15:10Z",
    "severity": "HIGH"
  },
  "details": "Use After Free in GitHub repository vim/vim prior to v9.0.2010.",
  "id": "GHSA-9h8h-jwrx-hxgg",
  "modified": "2023-10-11T21:33:25Z",
  "published": "2023-10-11T21:33:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5535"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vim/vim/commit/41e6f7d6ba67b61d911f9b1d76325cd79224753d"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/2c2d85a7-1171-4014-bf7f-a2451745861f"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDDWD25AZIHBAA44HQT75OWLQ5UMDKU3"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGTVLUV7UCXXCZAIQIUCLG6JXAVYT3HE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPT7NMYJRLBPIALGSE24UWTY6F774GZW"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9HG6-8R8X-Q6Q6

Vulnerability from github – Published: 2025-12-31 09:30 – Updated: 2025-12-31 09:30

Details

FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SFD files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28525.

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-15280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-31T07:15:52Z",
    "severity": "HIGH"
  },
  "details": "FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28525.",
  "id": "GHSA-9hg6-8r8x-q6q6",
  "modified": "2025-12-31T09:30:19Z",
  "published": "2025-12-31T09:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15280"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1188"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9HGF-JPQ5-R7R9

Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26

Details

Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a line box.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2011-2823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-08-29T15:55:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a line box.",
  "id": "GHSA-9hgf-jpq5-r7r9",
  "modified": "2022-05-13T01:26:33Z",
  "published": "2022-05-13T01:26:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2823"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13789"
    },
    {
      "type": "WEB",
      "url": "http://code.google.com/p/chromium/issues/detail?id=82552"
    },
    {
      "type": "WEB",
      "url": "http://googlechromereleases.blogspot.com/2011/08/stable-channel-update_22.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT4981"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT4999"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT5000"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-9HGG-6GF4-MX6P

Vulnerability from github – Published: 2022-01-14 00:01 – Updated: 2022-01-15 00:02

Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14847.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-34894"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-13T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14847.",
  "id": "GHSA-9hgg-6gf4-mx6p",
  "modified": "2022-01-15T00:02:30Z",
  "published": "2022-01-14T00:01:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34894"
    },
    {
      "type": "WEB",
      "url": "https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1483"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-9HGG-VXPH-4HW9

Vulnerability from github – Published: 2025-02-27 21:32 – Updated: 2025-02-27 21:32

Details

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free Read in tipc_named_reinit

syzbot found the following issue on:

BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764

CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted 5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 [...] ==================================================================

In the commit d966ddcc3821 ("tipc: fix a deadlock when flushing scheduled work"), the cancel_work_sync() function just to make sure ONLY the work tipc_net_finalize_work() is executing/pending on any CPU completed before tipc namespace is destroyed through tipc_exit_net(). But this function is not guaranteed the work is the last queued. So, the destroyed instance may be accessed in the work which will try to enqueue later.

In order to completely fix, we re-order the calling of cancel_work_sync() to make sure the work tipc_net_finalize_work() was last queued and it must be completed by calling cancel_work_sync().

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-49696"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:44Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix use-after-free Read in tipc_named_reinit\n\nsyzbot found the following issue on:\n==================================================================\nBUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0\nnet/tipc/name_distr.c:413\nRead of size 8 at addr ffff88805299a000 by task kworker/1:9/23764\n\nCPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted\n5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0\nHardware name: Google Compute Engine/Google Compute Engine,\nBIOS Google 01/01/2011\nWorkqueue: events tipc_net_finalize_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0xeb/0x495\nmm/kasan/report.c:313\n print_report mm/kasan/report.c:429 [inline]\n kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491\n tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413\n tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138\n process_one_work+0x996/0x1610 kernel/workqueue.c:2289\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\n kthread+0x2e9/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298\n \u003c/TASK\u003e\n[...]\n==================================================================\n\nIn the commit\nd966ddcc3821 (\"tipc: fix a deadlock when flushing scheduled work\"),\nthe cancel_work_sync() function just to make sure ONLY the work\ntipc_net_finalize_work() is executing/pending on any CPU completed before\ntipc namespace is destroyed through tipc_exit_net(). But this function\nis not guaranteed the work is the last queued. So, the destroyed instance\nmay be accessed in the work which will try to enqueue later.\n\nIn order to completely fix, we re-order the calling of cancel_work_sync()\nto make sure the work tipc_net_finalize_work() was last queued and it\nmust be completed by calling cancel_work_sync().",
  "id": "GHSA-9hgg-vxph-4hw9",
  "modified": "2025-02-27T21:32:15Z",
  "published": "2025-02-27T21:32:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49696"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/361c5521c1e49843b710f455cae3c0a50b714323"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8b246ddd394d7d9640816611693b0096b998e27a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/911600bf5a5e84bfda4d33ee32acc75ecf6159f0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cd7789e659e84f137631dc1f5ec8d794f2700e6c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9HJ4-R449-HFVC

Vulnerability from github – Published: 2026-08-07 18:33 – Updated: 2026-08-07 18:33

Summary

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Details

Summary

Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage.

When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.

An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys.

The issue was reproduced in the native C extension from the official RubyGems releases:

JSON 2.20.0
JSON 2.21.0
JSON 2.21.1

The attached evidence demonstrates:

an AddressSanitizer-confirmed heap-use-after-free;
a native SIGSEGV using the official JSON 2.21.1 RubyGem;
an end-to-end loopback TCP attacker/victim reproduction;
four differential controls;
successful execution after applying a tested patch control.

This was originally reported privately through Ruby's HackerOne program as report #3867755. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.

No code execution or information disclosure is claimed.

Details

The affected source is:

ext/json/ext/parser/parser.c

The vulnerable sequence in JSON 2.21.1 is:

cResumableParser_parse reaches the end of the current input buffer.
It calls json_str_clear(parser->buffer).
It sets parser->buffer = Qfalse.
The parser-state pointers into the released buffer are not reset.
partial_value makes a shallow copy of the parser state.
Reconstructing an incomplete object containing duplicate keys reaches the duplicate-key warning path.
cursor_position walks through the stale input pointers and reads released memory.

Relevant source locations:

Buffer release: https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L2562-L2569
Parser-state copy: https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L2647-L2654
Stale-pointer read in cursor_position: https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L590-L628
Duplicate-key handling path: https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L1196-L1255

When input is supplied to the resumable parser, the parser state stores direct pointers into the backing Ruby string:

RSTRING_GETMEM(parser->buffer, start, len);
parser->state.start = start;
parser->state.end = start + len;
parser->state.cursor = parser->state.start + offset;

After the current buffer has been consumed, cResumableParser_parse clears the string and removes the parser's reference to it:

if (eos(&parser->state)) {
    json_str_clear(parser->buffer);
    parser->buffer = Qfalse;
}

This path does not invalidate or replace:

parser->state.start
parser->state.cursor
parser->state.end

JSON::ResumableParser#partial_value subsequently makes a shallow copy of the parser structure:

JSON_ResumableParser *original_parser = cResumableParser_get(self);
JSON_ResumableParser parser = *original_parser;

When the partial object contains duplicate keys, reconstruction follows this call path:

cResumableParser_partial_value_body
  -> json_decode_object
  -> json_on_duplicate_key
  -> emit_duplicate_key_warning
  -> emit_parse_warning
  -> cursor_position

cursor_position then reads through pointers that may refer to released storage.

AddressSanitizer reports:

ERROR: AddressSanitizer: heap-use-after-free
cursor_position at parser.c:604
freed by cResumableParser_parse at parser.c:2567

The reproducer follows the normal resumable-parser API sequence:

parser << chunk
parser.parse
parser << next_chunk
parser.parse
parser.partial_value

The issue does not require:

an application-defined callback;
explicit garbage collection;
parser reentrancy;
custom parser options;
an attacker-supplied Ruby object;
manual modification of native parser state.

The release-build crash reproduced on JSON 2.20.0, 2.21.0, and 2.21.1.

This report covers the native C-extension implementation. The separate Java-platform implementation was not tested and is not claimed to be affected.

PoC

The complete evidence bundle is attached as:

ruby-json-resumable-partial-value-uaf-evidence-20260716.zip

SHA-256:

07bf8d47b115e45d6145d0447ab6c1c0255e4a7e9b2fb55c3c9a0e24406134ac

Requirements

Linux
Ruby with development headers
C compiler
make
RubyGems

Release-build, network, and differential reproduction

Extract the attachment:

unzip ruby-json-resumable-partial-value-uaf-evidence-20260716.zip
cd ruby-json-resumable-partial-value-uaf-evidence-20260716

Run the official JSON 2.21.1 release-build proof, loopback network proof, and differential controls:

./run_exact_2211.sh

Expected primary results:

release_exit=139
network_victim_exit=139
network_result=PASS
result=PASS

The following four differential controls must also report result=PASS:

unique_key
duplicate_allowed
no_partial
complete_document

The release-build crash stack includes:

cursor_position
emit_parse_warning
emit_duplicate_key_warning
json_decode_object
cResumableParser_partial_value_body

AddressSanitizer reproduction

Run:

./run_asan.sh

Expected vulnerable result:

asan_vulnerable_exit=134
ERROR: AddressSanitizer: heap-use-after-free
cursor_position at parser.c:604
freed by cResumableParser_parse at parser.c:2567

Expected patched-control result:

asan_patched_exit=0
asan_result=PASS

Affected-version matrix

The release-build crash was reproduced three times for each of the following official RubyGems releases:

json 2.20.0
json 2.21.0
json 2.21.1

Additional evidence is included in:

artifacts/exact-2211-e2e.txt
artifacts/asan-and-patched-control.txt
artifacts/version-matrix.txt
artifacts/source-and-release-verification.txt
source-slices.txt
prior-art.md
patch-control.diff

Impact

This is a use-after-free that can result in native Ruby process termination.

An attacker must be able to supply JSON stream data to an application that:

uses JSON::ResumableParser;
processes attacker-controlled streaming input;
calls partial_value after parsing an incomplete document containing duplicate object keys.

In network-facing deployments meeting these conditions, an attacker can cause process termination and denial of service.

The release-build crash was reproduced consistently in the tested Linux environment. The AddressSanitizer result confirms the underlying heap-use-after-free independently of normal allocator behavior.

The demonstrated impact is:

Denial of service through native process termination

No confidentiality impact, integrity impact, arbitrary code execution, or information disclosure is claimed.

Suggested remediation

Before clearing or releasing the resumable parser's input buffer, invalidate or replace every parser-state pointer that refers to the buffer's backing storage.

Delayed code paths such as duplicate-key warning generation must not calculate cursor positions using pointers after the corresponding buffer has been released.

The attached patch-control.diff demonstrates one tested control and is provided for validation rather than as a required final implementation.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.21.1"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "json"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.20.0"
            },
            {
              "fixed": "2.21.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71847"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-07T18:33:12Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\n\nRuby\u0027s JSON native C extension clears the consumed `JSON::ResumableParser` input buffer but leaves `state.start`, `state.cursor`, and `state.end` pointing into released storage.\n\nWhen `partial_value` reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls `cursor_position`, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.\n\nAn attacker who can supply JSON stream data to an application using `JSON::ResumableParser` may cause process termination when the application calls `partial_value` on incomplete attacker-controlled input containing duplicate object keys.\n\nThe issue was reproduced in the native C extension from the official RubyGems releases:\n\n* JSON 2.20.0\n* JSON 2.21.0\n* JSON 2.21.1\n\nThe attached evidence demonstrates:\n\n* an AddressSanitizer-confirmed heap-use-after-free;\n* a native `SIGSEGV` using the official JSON 2.21.1 RubyGem;\n* an end-to-end loopback TCP attacker/victim reproduction;\n* four differential controls;\n* successful execution after applying a tested patch control.\n\nThis was originally reported privately through Ruby\u0027s HackerOne program as report `#3867755`. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.\n\nNo code execution or information disclosure is claimed.\n\n### Details\n\nThe affected source is:\n\n```text\next/json/ext/parser/parser.c\n```\n\nThe vulnerable sequence in JSON 2.21.1 is:\n\n1. `cResumableParser_parse` reaches the end of the current input buffer.\n2. It calls `json_str_clear(parser-\u003ebuffer)`.\n3. It sets `parser-\u003ebuffer = Qfalse`.\n4. The parser-state pointers into the released buffer are not reset.\n5. `partial_value` makes a shallow copy of the parser state.\n6. Reconstructing an incomplete object containing duplicate keys reaches the duplicate-key warning path.\n7. `cursor_position` walks through the stale input pointers and reads released memory.\n\nRelevant source locations:\n\n* Buffer release:\n  https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L2562-L2569\n\n* Parser-state copy:\n  https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L2647-L2654\n\n* Stale-pointer read in `cursor_position`:\n  https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L590-L628\n\n* Duplicate-key handling path:\n  https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L1196-L1255\n\nWhen input is supplied to the resumable parser, the parser state stores direct pointers into the backing Ruby string:\n\n```c\nRSTRING_GETMEM(parser-\u003ebuffer, start, len);\nparser-\u003estate.start = start;\nparser-\u003estate.end = start + len;\nparser-\u003estate.cursor = parser-\u003estate.start + offset;\n```\n\nAfter the current buffer has been consumed, `cResumableParser_parse` clears the string and removes the parser\u0027s reference to it:\n\n```c\nif (eos(\u0026parser-\u003estate)) {\n    json_str_clear(parser-\u003ebuffer);\n    parser-\u003ebuffer = Qfalse;\n}\n```\n\nThis path does not invalidate or replace:\n\n```text\nparser-\u003estate.start\nparser-\u003estate.cursor\nparser-\u003estate.end\n```\n\n`JSON::ResumableParser#partial_value` subsequently makes a shallow copy of the parser structure:\n\n```c\nJSON_ResumableParser *original_parser = cResumableParser_get(self);\nJSON_ResumableParser parser = *original_parser;\n```\n\nWhen the partial object contains duplicate keys, reconstruction follows this call path:\n\n```text\ncResumableParser_partial_value_body\n  -\u003e json_decode_object\n  -\u003e json_on_duplicate_key\n  -\u003e emit_duplicate_key_warning\n  -\u003e emit_parse_warning\n  -\u003e cursor_position\n```\n\n`cursor_position` then reads through pointers that may refer to released storage.\n\nAddressSanitizer reports:\n\n```text\nERROR: AddressSanitizer: heap-use-after-free\ncursor_position at parser.c:604\nfreed by cResumableParser_parse at parser.c:2567\n```\n\nThe reproducer follows the normal resumable-parser API sequence:\n\n```ruby\nparser \u003c\u003c chunk\nparser.parse\nparser \u003c\u003c next_chunk\nparser.parse\nparser.partial_value\n```\n\nThe issue does not require:\n\n* an application-defined callback;\n* explicit garbage collection;\n* parser reentrancy;\n* custom parser options;\n* an attacker-supplied Ruby object;\n* manual modification of native parser state.\n\nThe release-build crash reproduced on JSON 2.20.0, 2.21.0, and 2.21.1.\n\nThis report covers the native C-extension implementation. The separate Java-platform implementation was not tested and is not claimed to be affected.\n\n### PoC\n\nThe complete evidence bundle is attached as:\n\n```text\nruby-json-resumable-partial-value-uaf-evidence-20260716.zip\n```\n\nSHA-256:\n\n```text\n07bf8d47b115e45d6145d0447ab6c1c0255e4a7e9b2fb55c3c9a0e24406134ac\n```\n\n#### Requirements\n\n* Linux\n* Ruby with development headers\n* C compiler\n* `make`\n* RubyGems\n\n#### Release-build, network, and differential reproduction\n\nExtract the attachment:\n\n```sh\nunzip ruby-json-resumable-partial-value-uaf-evidence-20260716.zip\ncd ruby-json-resumable-partial-value-uaf-evidence-20260716\n```\n\nRun the official JSON 2.21.1 release-build proof, loopback network proof, and differential controls:\n\n```sh\n./run_exact_2211.sh\n```\n\nExpected primary results:\n\n```text\nrelease_exit=139\nnetwork_victim_exit=139\nnetwork_result=PASS\nresult=PASS\n```\n\nThe following four differential controls must also report `result=PASS`:\n\n```text\nunique_key\nduplicate_allowed\nno_partial\ncomplete_document\n```\n\nThe release-build crash stack includes:\n\n```text\ncursor_position\nemit_parse_warning\nemit_duplicate_key_warning\njson_decode_object\ncResumableParser_partial_value_body\n```\n\n#### AddressSanitizer reproduction\n\nRun:\n\n```sh\n./run_asan.sh\n```\n\nExpected vulnerable result:\n\n```text\nasan_vulnerable_exit=134\nERROR: AddressSanitizer: heap-use-after-free\ncursor_position at parser.c:604\nfreed by cResumableParser_parse at parser.c:2567\n```\n\nExpected patched-control result:\n\n```text\nasan_patched_exit=0\nasan_result=PASS\n```\n\n#### Affected-version matrix\n\nThe release-build crash was reproduced three times for each of the following official RubyGems releases:\n\n```text\njson 2.20.0\njson 2.21.0\njson 2.21.1\n```\n\nAdditional evidence is included in:\n\n```text\nartifacts/exact-2211-e2e.txt\nartifacts/asan-and-patched-control.txt\nartifacts/version-matrix.txt\nartifacts/source-and-release-verification.txt\nsource-slices.txt\nprior-art.md\npatch-control.diff\n```\n\n### Impact\n\nThis is a use-after-free that can result in native Ruby process termination.\n\nAn attacker must be able to supply JSON stream data to an application that:\n\n1. uses `JSON::ResumableParser`;\n2. processes attacker-controlled streaming input;\n3. calls `partial_value` after parsing an incomplete document containing duplicate object keys.\n\nIn network-facing deployments meeting these conditions, an attacker can cause process termination and denial of service.\n\nThe release-build crash was reproduced consistently in the tested Linux environment. The AddressSanitizer result confirms the underlying heap-use-after-free independently of normal allocator behavior.\n\nThe demonstrated impact is:\n\n```text\nDenial of service through native process termination\n```\n\nNo confidentiality impact, integrity impact, arbitrary code execution, or information disclosure is claimed.\n\n### Suggested remediation\n\nBefore clearing or releasing the resumable parser\u0027s input buffer, invalidate or replace every parser-state pointer that refers to the buffer\u0027s backing storage.\n\nDelayed code paths such as duplicate-key warning generation must not calculate cursor positions using pointers after the corresponding buffer has been released.\n\nThe attached `patch-control.diff` demonstrates one tested control and is provided for validation rather than as a required final implementation.",
  "id": "GHSA-9hj4-r449-hfvc",
  "modified": "2026-08-07T18:33:13Z",
  "published": "2026-08-07T18:33:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ruby/json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams"
}

GHSA-9HQP-M898-4X8X

Vulnerability from github – Published: 2022-05-14 01:22 – Updated: 2025-11-25 18:32

Details

A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

Severity

9.8 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-5154"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-11T21:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.8, Thunderbird ESR \u003c 52.8, Firefox \u003c 60, and Firefox ESR \u003c 52.8.",
  "id": "GHSA-9hqp-m898-4x8x",
  "modified": "2025-11-25T18:32:13Z",
  "published": "2022-05-14T01:22:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5154"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2018-13"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2018-12"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2018-11"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4209"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4199"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3660-1"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3645-1"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201811-13"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201810-01"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00007.html"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1443092"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:1726"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:1725"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:1415"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:1414"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/104136"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1040896"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9HR2-JM6R-HHXQ

Vulnerability from github – Published: 2025-08-12 18:31 – Updated: 2025-08-12 18:31

Details

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-53137"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-12T18:15:37Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-9hr2-jm6r-hhxq",
  "modified": "2025-08-12T18:31:31Z",
  "published": "2025-08-12T18:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53137"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53137"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CWE-416

Use After Free

GHSA-9H69-JRQQ-936C

GHSA-9H6G-G22R-WGHG

GHSA-9H8H-JWRX-HXGG

GHSA-9HG6-8R8X-Q6Q6

GHSA-9HGF-JPQ5-R7R9

GHSA-9HGG-6GF4-MX6P

GHSA-9HGG-VXPH-4HW9

syzbot found the following issue on:

GHSA-9HJ4-R449-HFVC

Summary

Details

PoC

Requirements

Release-build, network, and differential reproduction

AddressSanitizer reproduction

Affected-version matrix

Impact

Suggested remediation

GHSA-9HQP-M898-4X8X

GHSA-9HR2-JM6R-HHXQ

Mitigation

Mitigation