ntop nDPI before version 6.0 contains a heap buffer overflow in the ndpi_json_string_escape function (CWE‑787). The function writes beyond the caller‑supplied buffer when processing crafted packet data, such as TLS SNI, HTTP headers, or DNS names, potentially corrupting heap memory. This corruption can lead to arbitrary code execution or application crashes by an attacker.

The affected product is ntop nDPI, all releases prior to 6.0. The vulnerability is present in the nDPI library bundled with these versions and can be triggered by network traffic parsed by the library.

The CVSS score of 8.3 indicates high severity. The EPSS score is not available, so the current probability of exploitation is uncertain. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network traffic; attackers can trigger the overflow by transmitting specially crafted packets from any side that reaches the vulnerable function. No authentication is required because packet parsing occurs on inbound traffic.