EUVD-2026-49129
GHSA-qv6q-8g2j-w47g
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack vector network (AV:N) per description; low complexity; no privileges or user interaction needed.
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.
Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
AnalysisAI
Integer overflow in the print_string_ptr() function of the cJSON library on 32-bit platforms causes a heap buffer overflow when processing crafted JSON strings with approximately 858,993,460 control characters. Applications using cJSON_PrintBuffered() with a pre-allocated buffer are vulnerable, potentially leading to remote code execution, information disclosure, or denial of service. No public exploit or active exploitation has been identified at the time of analysis.
Technical ContextAI
The cJSON library (CPE cpe:2.3:a:davegamble:cjson) is a lightweight JSON parser/writer written in C. The vulnerability is a classic integer overflow (CWE-190) in the print_string_ptr() function, where the escape_characters counter (size_t on 32-bit, 4 bytes) wraps when a string contains a very large number of control characters. This causes an undersized output buffer allocation, which is then written beyond its bounds in cJSON_PrintBuffered(). The issue is specific to 32-bit platforms where size_t is 32-bit; on 64-bit platforms size_t is 64-bit and the overflow condition requires impractically large inputs.
RemediationAI
No vendor-released patch is available as the project maintainer could not be contacted. The primary recommended mitigation is to use cJSON only on 64-bit platforms, where the size_t width prevents the integer overflow. Alternatively, avoid using cJSON_PrintBuffered() with pre-allocated buffers, or implement input validation to reject JSON strings containing an excessive number of control characters. Side effects: switching to 64-bit may not be feasible for embedded systems, and input validation could impact performance and functionality. Consider migrating to a different JSON library with active maintenance.
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. Rated critical severity (CVSS 9.8), this
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. Rated critical severity (CVSS 9.8)
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can r
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can resu
cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of func
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. Rated
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. Ra
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. Rated high severity (
Denial of service in cJSON (DaveGamble's C JSON parser) through version 1.7.19 lets a remote attacker crash any applicat
Denial of service in the cJSON C library (versions through 1.7.19) arises from exponential algorithmic complexity in the
Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 16.0 | Not-Affected |
| SUSE Linux Enterprise Server 16.1 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Not-Affected |
| openSUSE Leap 16.0 | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today