CVE-2026-16554 in cJSON
Summary
by MITRE • 07/27/2026
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.
Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The cJSON library represents a widely-used JSON parsing and generation library in C applications across various platforms and systems. This particular vulnerability stems from an integer overflow condition within the print_string_ptr() function located in cJSON.c, specifically manifesting on 32-bit architectures where size_t is limited to 32 bits. The flaw occurs when processing strings containing approximately 858,993,460 control characters or more, creating a scenario where the escape_characters counter undergoes wraparound due to its 32-bit nature. This integer overflow directly impacts buffer allocation calculations, leading to insufficient memory being allocated for output operations.
The technical execution of this vulnerability involves multiple stages that amplify its potential impact on system security. When cJSON_PrintBuffered() is invoked with a pre-allocated buffer, the library's internal logic determines the required buffer size based on the corrupted escape_characters counter value. This miscalculation results in heap memory allocation that is significantly smaller than what is actually required for the processing operation. Subsequent write operations attempt to populate this undersized buffer, causing heap buffer overflow conditions that can corrupt adjacent memory regions and potentially overwrite critical program data structures.
The operational impact of this vulnerability extends beyond simple denial of service scenarios to encompass more severe security implications including remote code execution and information disclosure. Attackers exploiting this condition on 32-bit platforms can craft malicious JSON input strings that trigger the integer overflow, enabling them to manipulate heap memory layout and potentially execute arbitrary code within the context of the vulnerable application. This vulnerability directly aligns with CWE-190, which describes integer overflow conditions, and maps to ATT&CK technique T1203 for process injection and T1059 for command and scripting interpreter usage. The attack surface is particularly concerning given cJSON's widespread adoption in embedded systems, IoT devices, and network applications where 32-bit architectures remain prevalent.
Mitigation strategies should focus on immediate version updates to patched releases of the cJSON library while implementing additional defensive measures such as input validation and bounds checking. Organizations should prioritize updating their software dependencies to versions that address this specific integer overflow condition, particularly in environments running 32-bit systems where the vulnerability is most exploitable. Input sanitization approaches including character count limits for JSON processing and memory allocation hardening techniques can provide additional protection layers. The vulnerability's confirmation in version 1.7.19 suggests potential prevalence across other versions of the library, making comprehensive dependency audits essential for system security. Security teams should also implement monitoring for anomalous JSON processing patterns that might indicate exploitation attempts targeting this specific heap overflow condition.