The vulnerability is a heap use‑after‑free that occurs when the symbol_keys option on a reused Oj::Parser instance is toggled from true to false. The internal key cache is freed but the pointer is not cleared, so the subsequent parse call reads from the freed memory, potentially corrupting heap data. This flaw corresponds to the classic use‑after‑free (CWE‑416) and improper memory management (CWE‑825). It can lead to unpredictable behavior, including crashes, data leakage, or arbitrary code execution, thereby compromising confidentiality, integrity, or availability of the application.

The affected product is the Ruby gem oj supplied by ohler55. Any Ruby application that loads oj 3.17.1 or earlier and reuses an Oj::Parser instance while changing the symbol_keys setting is susceptible. The library is commonly embedded in web services, background workers, and command‑line tools that process JSON payloads.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation. It is not listed in the CISA KEV catalog. Based on the description, the attack vector is most likely an attacker who can influence the Ruby code path that parses JSON, such as through a custom plug‑in, user‑supplied data, or a compromised dependency. If an attacker can force a parser instance to transition between symbol_keys settings, they can trigger the use‑after‑free and achieve memory corruption, potentially leading to further compromise.