Oj is a Ruby gem that parses JSON and can marshal objects. In versions before 3.17.2, the C parser creates a raw const byte * pointer into the Ruby string buffer. If a SAJ or SAJ2 callback mutates the JSON string, for example by calling String#replace and increasing the string length, Ruby reallocates the buffer and frees the original memory. The parser's pointer becomes dangling, and the next byte read triggers a heap use‑after‑free. This memory corruption flaw (CWE‑416) and improper handling of mutated data (CWE‑825) can result in a crash and, in worst‑case, potentially allow exploitation of corrupted memory.

The vulnerability affects the Ruby gem 'oj' produced by the vendor ohler55, specifically any version before 3.17.2. Any Ruby application that utilizes this gem and employs SAJ or SAJ2 callbacks that mutate JSON strings during parsing is susceptible.

The CVSS score of 2.1 indicates low severity. EPSS < 1% shows a very low probability of exploitation, and the vulnerability is not in the CISA KEV catalog. Exploitation requires an attacker that can supply specially crafted JSON to a Ruby process that uses a mutating SAJ/SAJ2 callback. The risk is primarily local to the application; it could cause a crash or destabilization but is unlikely to be used in widespread attacks. Therefore, the overall risk to affected users is modest.