LibJWT contains a vulnerability in the parsing routine for JSON Web Key (JWK) files that use RSA‑PSS keys. The code that extracts string values does not validate that the JSON token is indeed a string; if an attacker supplies a numeric value where a string is expected, the routine can dereference a null or out‑of‑bounds pointer. This flaw is classified as a NULL pointer dereference (CWE‑476) and can lead to application crashes or undefined behavior that may damage data integrity if the library is used in a critical context.

The issue affects the benmcollins/libjwt library, specifically releases between version 3.0.0 (inclusive) and 3.2.x (inclusive). Any C or C++ application that links against one of these library versions and processes JWK files containing RSA‑PSS keys is vulnerable, including authentication backends, token validators, or any service that imports keys from external sources.

The CVSS score of 5.8 indicates medium severity. EPSS is reported as less than 1 %, so the likelihood of exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is delivery of a specially crafted JWK file to an application that parses it. Attackers would need to supply the file, which is feasible via file upload, network transfer, or embedded content in a document. No public exploits are known, but the undefined behavior could potentially be leveraged for denial of service or memory corruption in untrusted environments.