Integer Overflow in cJSON Library for 32-bit Platforms
CVE-2026-16554

5.1MEDIUM

Key Information:

Vendor

Davegamble

Status
Cjson
Vendor
CVE Published:
27 July 2026

What is CVE-2026-16554?

The cJSON library contains an integer overflow vulnerability in the print_string_ptr() function when utilized on 32-bit platforms. Specifically, when processing strings with a high number of control characters, the escape_characters counter can exceed its maximum limit. This flaw leads to an underestimated buffer allocation in the cJSON_PrintBuffered() function, which can result in a heap buffer overflow. If an attacker provides a specially crafted JSON string to an application utilizing cJSON, it may allow remote code execution, data leakage, or denial of service. While confirmed in version 1.7.19, other versions may also be susceptible to this issue.

Affected Version(s)

cJSON 1.7.19

References

https://cert.pl/en/posts/2026/07/CVE-2026-16554
third-party-advisory
https://github.com/DaveGamble/cJSON
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.