OJ (Optimized JSON) is a Ruby gem that parses JSON and provides object marshalling. In versions prior to 3.17.2, the C parser holds a raw const byte * pointer into a Ruby string. A SAJ/SAJ2 callback that mutates the JSON string, such as by calling String#replace with a longer value, triggers Ruby to reallocate and free the original buffer. The parser’s pointer remains dangling, and the next byte read triggers a heap use‑after‑free. This vulnerability is a memory corruption flaw (CWE‑416) and a data structure inconsistency (CWE‑825), and can lead to program crashes or potential exploitation.

The vulnerability affects the Ruby gem ohler55:oj in all releases before 3.17.2. Any application that leverages Oj with SAJ or SAJ2 callbacks when parsing JSON is susceptible. The issue is fixed in version 3.17.2 and later, so updating the gem removes the vulnerability.

The EPSS score of < 1% indicates a very low probability of exploitation, and the CVE is not listed in CISA KEV. Exploitation requires a crafted JSON payload that triggers a mutating SAJ/SAJ2 callback, making the risk primarily application‑level. Attackers who control the input to Oj could trigger the use‑after‑free, which may cause a program crash. The low CVSS score and exploitation likelihood suggest that the overall risk to affected users is modest.