cJSON CVE-2026-67215

The target application must call cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() on an RFC 6902 JSON Patch document that the attacker can supply - this JSON Patch code path is the exact prerequisite, not mere JSON parsing. The malicious patch must contain add and copy operations that graft duplicated subtrees to amplify nesting beyond cJSON's 1000-level parser limit while staying under the 10000 CJSON_CIRCULAR_LIMIT so recursion in cJSON_Delete()/cJSON_Duplicate() overflows the stack. Limiting factors: exploitation is impossible if the application never exposes JSON Patch functionality to untrusted input; success also depends on the default thread stack size (a very large stack, or a hardened depth check on incoming patches, reduces or prevents the crash), and impact is confined to availability (process crash) with no code execution or data disclosure.

The CVSS 4.0 score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N and impact limited to availability (VA:H; no confidentiality or integrity impact), which correctly frames this as a pure denial-of-service condition rather than code execution. The network vector and lack of required privileges or user interaction make triggering trivial IN PRINCIPLE, but real-world exploitability is gated by a significant precondition not captured in the vector: the target application must actually expose the JSON Patch (cJSONUtils_ApplyPatches) functionality to attacker-controlled input, which is a comparatively uncommon code path versus plain cJSON_Parse. No EPSS score was provided in the input, KEV status is NO (not actively exploited), and no proof-of-concept exploit is flagged - only a detailed technical write-up exists. Net assessment: a genuine, low-complexity crash bug worth patching in any service that applies untrusted JSON Patches, but of limited priority for deployments that do not use the JSON Patch API. Missing signals: EPSS probability and confirmed POC availability are not in the provided data.

A web API accepts RFC 6902 JSON Patch documents to update stored JSON resources and applies them with cJSONUtils_ApplyPatches(). An unauthenticated attacker submits a small patch composed of chained add and copy operations that duplicate subtrees to force document nesting past the 1000-level limit; when the library recurses through cJSON_Delete()/cJSON_Duplicate() the thread stack overflows and the process crashes. A detailed technical write-up exists but no packaged POC exploit is identified in the provided data; given AV:N/AC:L the attack is straightforward wherever the JSON Patch path is reachable.