EUVD-2026-86268
GHSA-44gx-vjqj-w54m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed JSON payload
-
ExploitDeliver file/stdin to jsondump example
-
ExecutionTrigger out-of-bounds read in dump()
-
ImpactLeak adjacent memory or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the vulnerable code path - the dump() function in jsmn's example/jsondump.c - to actually be built and run, and for the attacker to supply crafted/malformed JSON as input to that utility. Because jsondump is shipped as an example/demo rather than the core jsmn.h parser, the realistic precondition is that a developer copied or deployed this example code into a tool or pipeline that processes untrusted JSON. Limiting factors: the code is a local command-line consumer (not a listening network service), so despite the NVD AV:N the practical vector is local/user-driven and depends on someone running the demo on attacker-controlled input; core jsmn.h library users who do not use the example are not affected. |
| Impact | The signals paint a consistently LOW real-world priority despite the 7.3 (High) base score. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) drives the score up via network vector and no privileges, but this is questionable: the affected code is example/jsondump.c, a standalone command-line demo that reads JSON from stdin/a file and pretty-prints it - a locally-run parsing utility, not a network service. AV:N and UI:N are almost certainly overstated; realistic exploitation requires a victim to run jsondump against attacker-supplied JSON, which is AV:L/UI:R. EPSS agrees the threat is negligible at 0.15% (4th percentile). There is no CISA KEV listing and no public exploit code identified - only a GitHub issue (#249). CWE-125 (out-of-bounds read) fits an information-leak/crash outcome far better than a write-based 'Buffer Overflow', so the C:L/A:L impact is credible while I:L is dubious for a pure read. Net: a genuinely low-risk issue in example code that is inflated by an overly network-oriented CVSS vector; treat as informational, not urgent. |
| Exploit ScenarioDerived | An attacker crafts a malformed JSON document with an inconsistent/oversized token count and induces a developer or automated pipeline to run the jsmn jsondump example (dump()) against it. During recursive token printing the code reads past the intended token/buffer bounds, leaking adjacent memory into output or crashing the process. No public exploit or POC has been published - only an upstream GitHub bug report (issue #249) exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
An out-of-bounds read in the dump() function of the jsmn JSON tokenizer's demo utility example/jsondump.c (commit 25647e6) allows an attacker who supplies crafted or malformed JSON to the program to disclose small amounts of adjacent process memory and to crash the utility, giving a confidentiality and availability impact rated Low. Only users who build and run the shipped example - or who copied that demo code into a tool or pipeline that parses untrusted JSON - are affected; consumers of the core jsmn.h library who do not use the example are not exposed. The 7.3 base score is not matched by real-world signals: EPSS is 0.15 percent (4th percentile), there is no CISA KEV entry, and no public exploit was identified at time of analysis, and the assessed vector is local with required user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), so this is a low practical priority rather than a remotely exploitable high-severity issue.
RemediationAI
No vendor-released patch identified at time of analysis; no patched release or fix version is cited in the available data, and the only upstream reference is the open issue at https://github.com/zserge/jsmn/issues/249, which should be monitored for a commit or advisory, with the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-88369 used as the canonical record. Because the defect lives in example/demo code rather than the core parser, the most direct and lowest-cost remediation is to remove or stop building example/jsondump.c in any tool, image, or CI pipeline that processes untrusted JSON - this eliminates the exposure entirely with no functional loss to consumers of jsmn.h. If the utility must be retained, treat it as untrusted-input software: add explicit bounds checks in dump() that validate each token's start/length against the input buffer before dereferencing, reject malformed/truncated input before dumping, and rebuild the utility with AddressSanitizer or a hardened allocator so that any residual over-read aborts the process instead of silently leaking adjacent memory - the trade-off being that this converts a quiet over-read into a hard crash (availability impact) rather than removing the underlying bug. Additional compensating controls include running the utility as an unprivileged, sandboxed user with no access to secrets or sensitive files on the same host, and gating it behind an input-validation step that rejects non-conforming JSON before the tokenizer is invoked; neither control fixes the root cause and both should be treated as temporary. If an upstream fix is later published, update to the release that contains it and confirm the fixed commit is the one that addresses issue 249 rather than assuming any subsequent revision is patched.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
jsmn (zserge/jsmn) is a minimal, header-only C library that tokenizes JSON into a flat array of token structures rather than building a DOM; the repository additionally ships example utilities, one of which is example/jsondump.c, a small command-line program that walks the token array produced by jsmn_parse() and pretty-prints it. The vulnerability class is CWE-125 (out-of-bounds read), which is consistent with the reference issue being a parser/demo input-handling defect rather than a memory-corruption write: when the demo is fed malformed or truncated JSON (for example unterminated strings or token lengths that do not correspond to the supplied buffer), the dump() routine indexes past the bounds of the parsed input and reads adjacent memory. That read can leak a limited amount of process memory (C:L) and can terminate the process on an access violation (A:L), matching the assessed vector's confidentiality and availability impacts and the absence of an integrity impact. Note the tension in the source data: the supplied tags describe this as a 'Buffer Overflow', but the assigned CWE (CWE-125) and the assessed impact profile indicate an out-of-bounds read, not a write primitive, so no code execution or memory-corruption primitive should be assumed. The provided CPE string is unpopulated (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and EUVD lists the affected version as 'n/a n/a', meaning no versioned product identity has been registered; the actionable identifier is the repository commit 25647e6 and the file path example/jsondump.c. Because jsmn is a local command-line consumer and not a listening network service, the NVD AV:N classification does not reflect a practical remote attack path; the realistic attack surface is someone running the demo (or a copy of it) over attacker-controlled JSON, which is why the assessed vector is AV:L with UI:R.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
jsondump is a locally-run CLI demo processing user-supplied JSON, so AV:L/UI:R; an out-of-bounds read yields limited info leak (C:L) or crash (A:L) with no integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().
Executive ViewAI
The jsmn JSON tokenizer's demo utility (example/jsondump.c) contains a memory disclosure and crash vulnerability that only affects organizations that have built and deployed this example code-or copied it into custom tools-to parse untrusted JSON. While the CVSS score is 7.3, real-world risk is low: the vulnerability requires local access and user interaction, and no public exploit identified at time of analysis. Leadership should ensure that any use of this demo utility is identified and mitigated, but core jsmn.h library consumers are not exposed.
Avoid using the jsmn demo utility (example/jsondump.c) to parse untrusted JSON; use the core jsmn.h library instead, which is not affected. If the demo utility must be used, restrict execution to trusted input, run it with minimal privileges, and monitor for crashes or anomalous memory disclosures. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB