CVE-2026-16554
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-190
Desbordamiento o ajuste de enteros
Fecha de publicación:
27/07/2026
Última modificación:
27/07/2026
Descripción
*** Pendiente de traducción *** cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.<br />
<br />
<br />
<br />
<br />
Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
Impacto
Puntuación base 4.0
5.10
Gravedad 4.0
MEDIA