CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2014-4616
Medium (5.9). EPSS 7.8% chance of exploitation in the next 30 days. Fixed in simplejson 2.6.1.
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
Severity
- EPSS
- 7.8% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-129
- Published
- Modified
- Record from
- the NVD, synced
Affected
- opensuse:opensuse
- opensuse_project:opensuse
- python:python
- simplejson_project:simplejson
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9772-cwx9-r4cj | PyPI | simplejson | <2.6.1 | 2.6.1 |
| PYSEC-2026-921 | PyPI | simplejson | <2.6.1 | 2.6.1 |