The extractFrom function in Internals/QuotedString.cpp in Arduino JSON prior to 4.5 allows remote malicious users to cause a denial of service (crash) via a JSON string with a \ (backslash) followed by a terminator, as demonstrated by "\\\0", which triggers a buffer overflow and over-read.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
arduino json project arduino json |
Vulmon