An off-by-one write occurs in Envoy's JsonEscaper::escapeString(), which corrupts the null-termination of std::string objects. This vulnerability can lead to undefined behavior, such as program crashes or out-of-bounds reads when the string is later used as a C-string. The weakness is a typical C string handling flaw identified as CWE-193.

The affected product is Envoy Proxy from the envoyproxy organization. Versions before 1.37.1, 1.36.5, 1.35.8, and 1.34.13 are vulnerable, including the 1.37.0 release as noted in the CPE data.

The CVSS score of 5.3 indicates a medium impact, while the EPSS score of less than 1% shows that the probability of exploitation is considered low at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered during JSON string escaping, it can be triggered remotely via crafted requests that contain malicious JSON content, although no known publicly available exploits have been reported.