The jsmn JSON parser contains a classic buffer overflow in the dump() function of example/jsondump.c. The overflow occurs when the function processes input without proper bounds checking, permitting an attacker to write beyond the allocated buffer and potentially overwrite adjacent memory. This flaw can lead to arbitrary code execution or a crash if an attacker supplies a malicious JSON string.

Any application that includes the jsmn library and uses the example/jsondump.c code—specifically the commit identified as 25647e6—shares this vulnerability. No version range is provided, so projects that did not upgrade beyond this commit are affected.

The CVSS score of 7.3 indicates a high severity vulnerability. The EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog, indicating a low but non-zero likelihood of exploitation. An attacker who supplies a large or malformed JSON string to the vulnerable dump() routine could trigger the overflow, leading to arbitrary code execution or a crash.