Executive brief
cJSON is a lightweight software library used by developers to process JSON data. A vulnerability exists on 32-bit systems where processing extremely large, specially crafted data strings can cause the library to crash or potentially allow unauthorized code execution. This could lead to service outages or the exposure of sensitive information in applications that rely on this library.
Technical details
An integer overflow vulnerability (CWE-190) exists in the print_string_ptr() function within cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters. This causes the output buffer to be allocated with an underestimated length. When cJSON_PrintBuffered() is subsequently used with a pre-allocated buffer, the write loop overflows the heap allocation. An attacker can exploit this by supplying a crafted JSON string to trigger a heap buffer overflow, potentially resulting in remote code execution (RCE), information disclosure, or denial of service (DoS). As of the advisory date, the vendor has not been successfully contacted, and a patch is not confirmed.
Affected products
- DaveGamble cJSON 1.7.19
Timeline
- 2026-07-27: advisory: Advisory published by CERT.PL
- 2026-07-27: disclosed