A buffer overflow occurs during parsing in the zserge jsmn library when processing JSON with the jsmn_parse and dump functions. The vulnerability can be triggered by a specially crafted JSON string and leads to a program crash, causing a denial of service. The attack does not directly expose data or allow code execution, but it can disrupt services relying on the library, affecting availability.

Any installation that uses the zserge jsmn parser at its current HEAD commit 25647e6 is affected. This includes projects that compile the library into applications or use it as a dependency in C or similar environments. No vendor was identified, but any application that incorporates this code contains the flaw.

The CVSS score is 3.7, and the EPSS score is < 1%, so the exact likelihood cannot be quantified. However, the nature of a buffer overflow means the vulnerability is exploitable with relative ease by an attacker who can supply JSON input to the target. The fix appears in pull request 250, but no KEV listing indicates no confirmed widespread exploitation yet. The risk to availability is high for systems unable to contain the faulting process.