Vulnerability Spotlight: ESnet iPerf3 JSON parse_string UTF Code Execution Vulnerability
Summary: Cisco Talos discovered a heap overflow vulnerability in the forked cJSON library shipped with iPerf3 3.1-1, caused by the parse_string() function incrementing its buffer pointer by four bytes regardless of actual string length when it encounters a quote character in a UTF-8/16 string. A long enough string lets an attacker overwrite heap block headers and potentially achieve remote code execution on systems running the iPerf3 server daemon, and Talos notes several public iPerf3 servers reachable from the internet may be susceptible.
Why it matters: The flaw sits in a library bundled inside a network measurement tool, not in the tool's own code, and the tested version dates to 2015 - so any iPerf3 server still exposed to the internet is running a parsing bug that can hand an attacker the heap.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026