A classic buffer overflow exists in the cJSON parsing component of RethinkDB. The flaw allows an attacker to supply an input payload larger than the destination buffer, causing an overwrite of adjacent memory. If successfully exploited, this could lead to arbitrary code execution under the privileges of the RethinkDB process, impacting confidentiality, integrity, and availability. The weakness is identified as CWE‑120.

The vulnerability is present in all publicly released versions of RethinkDB up to and including 2.4.4. RethinkDB is an open‑source distributed database system that typically runs as a server process listening on network ports. Users who maintain a RethinkDB cluster must ensure they are not running any of the affected releases.

The CVSS score of 10 marks it as critical, yet its EPSS of less than 1% suggests that exploit activity is very uncommon at present. It is not listed in the CISA KEV catalog, so there is no immediate evidence of active exploitation. Nonetheless, because the flaw can potentially enable remote code execution through malicious JSON payloads sent over the network, the attack vector is likely remote. Administrators should treat it as a high‑risk vulnerability that warrants prompt remediation.