Executive brief
cJSON is a widely used C library for parsing and manipulating JSON data, often found in embedded firmware and server-side applications. A flaw in its JSON Patch implementation allows an attacker to partially corrupt or delete data within a document even if the overall update operation is reported as a failure. This breaks the expected 'all-or-nothing' behavior of data updates, potentially leading to data loss or inconsistent application states.
Technical details
The vulnerability exists in the `apply_patch()` function within `cJSON_Utils.c`. When processing 'replace' or 'move' operations, the library detaches and deletes the target member before completing the validation of the operation (e.g., checking for a missing 'value' member or resolving a destination path). Because these operations are non-atomic, a malformed patch can cause permanent mutation of the target document despite `cJSONUtils_ApplyPatches()` returning a failure status. An attacker capable of providing a patch document can exploit this 'Incorrect Behavior Order' (CWE-696) to destroy addressable members of the target JSON structure. As of version 1.7.19, no official patch has been merged.
Affected products
- DaveGamble cJSON through 1.7.19
Timeline
- 2026-07-29: disclosed: Vulnerability details published by Joshua Rogers
- 2026-07-29: advisory: NVD and VulnCheck advisories published