CVE-2026-16554

Name of the Vulnerable Software and Affected Versions cJSON version 1.7.19

Description An integer overflow exists in the print string ptr() function within cJSON.c on 32-bit platforms. The escape characters counter, a 32-bit size t, can wrap around when processing strings containing approximately 858,993,460 or more control characters. This leads to the output buffer being allocated with an underestimated length. When cJSON PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop causes a heap buffer overflow. An attacker can exploit this by providing a crafted JSON string to an application using the library on a 32-bit platform, potentially resulting in remote code execution, information disclosure, or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.