EUVD-2026-49129
GHSA-qv6q-8g2j-w47g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify 32-bit target using cJSON
-
DeliveryCraft JSON with ~858M control characters
-
ExploitSend crafted input to application
-
InstallTrigger integer overflow in print_string_ptr()
-
C2Under-allocate output buffer
-
ExecuteWrite beyond buffer bounds
-
ImpactAchieve heap corruption and code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerability requires: (1) a 32-bit platform where size_t is 4 bytes; (2) the application must call cJSON_PrintBuffered() with a pre-allocated buffer; (3) the input JSON string must contain approximately 858,993,460 or more control characters to trigger the overflow. No authentication is required, but the attack is limited by the massive input size and the specific 32-bit architecture. These conditions significantly restrict realistic exploitation compared to the raw CVSS score. |
| Impact | The CVSS 4.0 vector provided (AV:L/AC:L/PR:N/UI:N) indicates a local attack vector, yet the description suggests an attacker can supply a crafted JSON string remotely (e.g., via network). This discrepancy must be resolved with the vendor. The SSVC decision framework rates exploitation as none and technical impact as partial, while no EPSS score or KEV listing is available. Given the lack of exploit code and the requirement for a 32-bit architecture and specific API usage, the real-world risk is low to medium for affected platforms. The high bar of ~858 million control characters further reduces practicality. |
| Exploit ScenarioDerived | An attacker sends a crafted JSON string containing over 858 million control characters to a network-facing application running on a 32-bit system that uses cJSON_PrintBuffered() with a pre-allocated buffer. The integer overflow in print_string_ptr() causes an undersized heap allocation, and the subsequent write loop overflows the buffer, corrupting adjacent memory and potentially allowing arbitrary code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Integer overflow in the print_string_ptr() function of the cJSON library on 32-bit platforms causes a heap buffer overflow when processing crafted JSON strings with approximately 858,993,460 control characters. Applications using cJSON_PrintBuffered() with a pre-allocated buffer are vulnerable, potentially leading to remote code execution, information disclosure, or denial of service. No public exploit or active exploitation has been identified at the time of analysis.
RemediationAI
No vendor-released patch is available as the project maintainer could not be contacted. The primary recommended mitigation is to use cJSON only on 64-bit platforms, where the size_t width prevents the integer overflow. Alternatively, avoid using cJSON_PrintBuffered() with pre-allocated buffers, or implement input validation to reject JSON strings containing an excessive number of control characters. Side effects: switching to 64-bit may not be feasible for embedded systems, and input validation could impact performance and functionality. Consider migrating to a different JSON library with active maintenance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The cJSON library (CPE cpe:2.3:a:davegamble:cjson) is a lightweight JSON parser/writer written in C. The vulnerability is a classic integer overflow (CWE-190) in the print_string_ptr() function, where the escape_characters counter (size_t on 32-bit, 4 bytes) wraps when a string contains a very large number of control characters. This causes an undersized output buffer allocation, which is then written beyond its bounds in cJSON_PrintBuffered(). The issue is specific to 32-bit platforms where size_t is 32-bit; on 64-bit platforms size_t is 64-bit and the overflow condition requires impractically large inputs.
Know when Cjson gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L
Attack vector network (AV:N) per description; low complexity; no privileges or user interaction needed.
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.
Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. Rated critical severity (CVSS 9.8), this
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. Rated critical severity (CVSS 9.8)
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can r
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can resu
cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of func
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. Rated
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. Ra
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. Rated high severity (
Heap use-after-free in DaveGamble cJSON's cJSONUtils_MergePatch function (cJSON_Utils.c) affects all versions through 1.
Denial of service in cJSON (DaveGamble's C JSON parser) through version 1.7.19 lets a remote attacker crash any applicat
Denial of service in the cJSON C library (versions through 1.7.19) arises from exponential algorithmic complexity in the
Same weakness CWE-190 – Integer Overflow or Wraparound
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 16.0 | Not-Affected |
| SUSE Linux Enterprise Server 16.1 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Not-Affected |
| openSUSE Leap 16.0 | Not-Affected |
Exploit-DB