Executive brief
struct2json is a C library used to convert between C structures and JSON data. The library fails to validate JSON node types before attempting string operations, allowing a malformed JSON input (e.g., a number field where a string is expected) to crash the application with a null pointer dereference. An attacker can remotely trigger this crash by sending crafted JSON, causing service unavailability.
Technical details
The vulnerability is a null pointer dereference in the S2J_STRUCT_GET_string_ELEMENT macro within struct2json/inc/s2jdef.h. The vulnerable code attempts to copy the valuestring field from a cJSON node without first validating that the node is actually a string type. When a JSON input contains a non-string value (e.g., a number) where a string field is expected, the valuestring pointer is NULL, and the subsequent strncpy() call dereferences it, causing a crash. The attack is network-reachable and requires no authentication or special preconditions beyond the ability to provide JSON input to an application using the library. An attacker can remotely crash applications that deserialize untrusted JSON data using this library. The vendor has not responded to early disclosure.
Affected products
- armink struct2json 1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory: CVE-2026-82803 published on NVD