Oj.load, a JSON parsing function of the Ruby gem Oj, is vulnerable in versions before 3.17.2 to an integer overflow when handling a JSON string longer than 2 GB. The overflow occurs during a buffer append operation, converting the length to a large negative size_t and causing memcpy to copy an astronomically large amount of data out of bounds, which corrupts adjacent heap memory. The resulting heap corruption can crash the process and potentially modify other objects. The flaw is classified as integer overflow (CWE-190) and buffer overflow (CWE-787).

Ruby applications that depend on the ohler55:oj gem, specifically any similar version earlier than 3.17.2 that uses Oj.load to parse untrusted or large JSON payloads.

The CVSS score of 6.3 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a very low probability of exploitation. Since the vulnerability is not listed in the CISA KEV catalog, the risk is primarily related to service disruption if JSON payloads are processed. Based on the description, it is inferred that the likely attack vector is supplying a JSON document larger than 2 GB to any application that uses Oj.load, which may be remotely reachable if the application accepts JSON over a network interface. The flaw is classified as integer overflow (CWE-190) and buffer overflow (CWE-787), and it may lead to denial of service or potentially corrupt adjacent memory, affecting application integrity.