CVE-2026-16554
published 2026-07-27CVE-2026-16554: cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit…
PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.29%
20.6th percentile
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.
Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| davegamble | cjson | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.1MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON
vendor_redhat·2026-07-27·CVSS 5.1
CVE-2026-16554 [MEDIUM] CWE-131 cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON
cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON
A flaw was found in the cJSON library. On 32-bit platforms, a specially crafted JSON string can cause an integer overflow in the `print_string_ptr()` function. This vulnerability can lead to a heap buffer overflow, which an attacker could exploit to achieve remote code execution, disclose sensitive information, or cause a denial of service.
Statement: This flaw is an integer overflow in the print_string_ptr() function of the cJSON library. A 32-bit size_t counter used to track escape characters can wrap around when a JSON string contains approximately 858,993,460 or more control characters, causing an undersized heap buffer to be allocated and subsequently overflowed when the JSON is printed.
This issue does not
GHSA
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms.
ghsa_unreviewed·2026-07-27
CVE-2026-16554 [MEDIUM] CWE-190 cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms.
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.
Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in ver
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-16554 86box: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
bugzilla·2026-07-27·CVSS 5.1
CVE-2026-16554 [MEDIUM] CVE-2026-16554 86box: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
CVE-2026-16554 86box: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation.
Bugzilla
CVE-2026-16554 cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON
bugzilla·2026-07-27·CVSS 5.1
CVE-2026-16554 [MEDIUM] CVE-2026-16554 cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON
CVE-2026-16554 cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.
Because project
Bugzilla
CVE-2026-16554 mmc: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
bugzilla·2026-07-27·CVSS 5.1
CVE-2026-16554 [MEDIUM] CVE-2026-16554 mmc: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
CVE-2026-16554 mmc: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An
Bugzilla
CVE-2026-16554 dcm2niix: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
bugzilla·2026-07-27·CVSS 5.1
CVE-2026-16554 [MEDIUM] CVE-2026-16554 dcm2niix: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
CVE-2026-16554 dcm2niix: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocatio
Bugzilla
CVE-2026-16554 cjson: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
bugzilla·2026-07-27·CVSS 5.1
CVE-2026-16554 [MEDIUM] CVE-2026-16554 cjson: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
CVE-2026-16554 cjson: cJSON: Remote code execution due to integer overflow via crafted JSON [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation.
2026-07-27
Published