EUVD-2026-260129

fkie_cve-2024-25713

yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)

GHSA-whx6-m9j4-w2m2 — yyjson has a Double Free vulnerability

Affected: SwiftURL: github.com/ibireme/yyjson

### Summary

The pool series allocator (pool_malloc/pool_free/pool_realloc) by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service (DoS) attacks. Arbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library, can lead to remote code execution.

### Details

The core cause of this vulnerability lies in the pool_free function's lack of loop checks, while the direct cause stems from the pool_free function and similar free-series functions not performing pointer destruction, resulting in Use-After-Free (UAF) vulnerabilities.

### PoC

Below, a C language program using yyjson 0.8.0 is written to show how to exploit a Double Free vulnerability to cause chunk overlaps, which then allows the modification of a chunk's next pointer to point to an arbitrary address. If the targeted address is valid, modifications can be made. However, if the address is invalid, it could lead to the program crashing, which could be exploited for a Denial of Service (DoS) attack. Additionally, constructing a cyclic chain of chunks could force the service into an infinite loop, also exploitable for a DoS attack.

``` #include <stdio.h> #include "yyjson.h"

char test[0x110]; int64_t a=0xffffffff; int64_t b= (int64_t) test;

int main() {

size_t max_json_size = 64 * 1024;

size_t buf_size = yyjson_read_max_memory_usage(max_json_size, 0);

void *buf = malloc(buf_size);

yyjson_alc alc;…

Most recent entries from all

EUVD-2026-260129

fkie_cve-2024-25713

GHSA-whx6-m9j4-w2m2 — yyjson has a Double Free vulnerability

gsd-2024-25713