Integer Overflow Leading to Heap Buffer Overflow in cJSON
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DaveGamble | cJSON | 1.7.19 | — | No fix listed | CNA |
- cJSON VendorDaveGamble Affected 1.7.19 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:davegamble:cjson:1.7.19:*:*:*:*:*:*:* | 1.7.19 | Vulnerable | DaveGamble |
- cpe:2.3:a:davegamble:cjson:1.7.19:*:*:*:*:*:*:* Versions 1.7.19 Vulnerable ·DaveGamble
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Enterprise Linux 8
- Red Hat Hardened Images
- Red Hat OpenShift Container Platform 4
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16554
- 2026-10-03 Alias added: GHSA-qv6q-8g2j-w47g
References
More DaveGamble Cjson vulnerabilities
- TI-2025-35424 cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the… CVSS 3.1CRITICAL 9.8
- TI-2023-27613 cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. CVSS 3.1HIGH 7.5
- TI-2026-47533 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation CVSS 4.0MEDIUM 6.9
- TI-2026-47532 cJSON cJSON_Compare Exponential Complexity Denial of Service CVSS 4.0HIGH 8.2
- TI-2019-08871 cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. CVSS 3.1CRITICAL 9.8
- TI-2019-08870 cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-16554 · CVE Program
- CVE-2026-16554 · NVD
- FIRST EPSS
- GHSA-qv6q-8g2j-w47g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-16554 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences