Is CVE-2026-67217 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67217 being exploited in the wild.

How severe is CVE-2026-67217?

Medium severity, with a CVSS score of 5.3, published 29 July 2026.

Which products and versions are affected?

DaveGamble cJSON through 1.7.19.

Is there a fix for CVE-2026-67217?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67217 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67217?

Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67217: DaveGamble cJSON non-atomic JSON Patch application in cJSON_Utils.c

CVE-2026-67217 · Severity: medium · CVSS 5.3 · Published 2026-07-29

cJSON is a widely used C library for parsing and manipulating JSON data, often found in embedded firmware and server-side applications. A flaw in its JSON Patch implementation allows an attacker to partially corrupt or delete data within a document even if the overall update operation is reported as a failure. This breaks the expected 'all-or-nothing' behavior of data updates, potentially leading to data loss or inconsistent application states.

Technologies: DaveGamble cJSON. Vendors: DaveGamble.

Quick answers

Is CVE-2026-67217 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67217 being exploited in the wild.
How severe is CVE-2026-67217?: Medium severity, with a CVSS score of 5.3, published 29 July 2026.
Which products and versions are affected?: DaveGamble cJSON through 1.7.19.
Is there a fix for CVE-2026-67217?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67217 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67217?: Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `apply_patch()` function within `cJSON_Utils.c`. When processing 'replace' or 'move' operations, the library detaches and deletes the target member before completing the validation of the operation (e.g., checking for a missing 'value' member or resolving a destination path). Because these operations are non-atomic, a malformed patch can cause permanent mutation of the target document despite `cJSONUtils_ApplyPatches()` returning a failure status. An attacker capable of providing a patch document can exploit this 'Incorrect Behavior Order' (CWE-696) to destroy addressable members of the target JSON structure. As of version 1.7.19, no official patch has been merged.

Affected products

DaveGamble cJSON through 1.7.19

Timeline

2026-07-29: disclosed: Vulnerability details published by Joshua Rogers
2026-07-29: advisory: NVD and VulnCheck advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.