CVE-2026-16554

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16554", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-07-22T11:49:39.961Z", "datePublished": "2026-07-27T08:40:17.183Z", "dateUpdated": "2026-07-31T13:34:05.448Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-27T08:40:17.183Z"}, "title": "Integer Overflow Leading to Heap Buffer Overflow in cJSON", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound", "type": "CWE"}]}], "affected": [{"vendor": "DaveGamble", "product": "cJSON", "repo": "https://github.com/DaveGamble/cJSON", "modules": ["cJSON.c"], "versions": [{"status": "affected", "version": "1.7.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.<div><br></div><div><p>Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.</p></div>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-16554", "tags": ["third-party-advisory"]}, {"url": "https://github.com/DaveGamble/cJSON", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L"}}], "configurations": [{"lang": "en", "value": "32-bit platforms", "supportingMedia": [{"type": "text/html", "base64": false, "value": "32-bit platforms"}]}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Marcin Wyczechowski (AFINE Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T10:24:13.881075Z", "id": "CVE-2026-16554", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T10:24:23.056Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/30/26"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/31/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-31T13:34:05.448Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/30/26"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/31/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-31T13:34:05.448Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16554", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T10:24:13.881075Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T10:24:19.293Z"}}], "cna": {"tags": ["x_open-source"], "title": "Integer Overflow Leading to Heap Buffer Overflow in cJSON", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE Team)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE Team)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/DaveGamble/cJSON", "vendor": "DaveGamble", "modules": ["cJSON.c"], "product": "cJSON", "versions": [{"status": "affected", "version": "1.7.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-16554", "tags": ["third-party-advisory"]}, {"url": "https://github.com/DaveGamble/cJSON", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.", "supportingMedia": [{"type": "text/html", "value": "cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.<div><br></div><div><p>Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.</p></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound"}]}], "configurations": [{"lang": "en", "value": "32-bit platforms", "supportingMedia": [{"type": "text/html", "value": "32-bit platforms", "base64": false}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-27T08:40:17.183Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16554", "state": "PUBLISHED", "dateUpdated": "2026-07-31T13:34:05.448Z", "dateReserved": "2026-07-22T11:49:39.961Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-07-27T08:40:17.183Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["cJSON.c"], "product": "cJSON", "repo": "https://github.com/DaveGamble/cJSON", "vendor": "DaveGamble", "versions": [{"status": "affected", "version": "1.7.19", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:davegamble:cjson:1.7.19:*:*:*:*:*:*:*", "matchCriteriaId": "0FE04ECA-71CF-4F94-86DD-3F2936568058", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."}, {"lang": "es", "value": "La biblioteca cJSON es vulnerable a un desbordamiento de entero en la funci\u00f3n print_string_ptr() en cJSON.c en plataformas de 32 bits. El contador escape_characters, un size_t de 32 bits, puede desbordarse al procesar cadenas que contienen aproximadamente 858,993,460 o m\u00e1s caracteres de control, lo que provoca que el b\u00fafer de salida se asigne bas\u00e1ndose en una longitud subestimada. Cuando se utiliza cJSON_PrintBuffered() con un b\u00fafer preasignado, el bucle de escritura posterior desborda la asignaci\u00f3n de memoria din\u00e1mica. Un atacante que proporciona una cadena JSON manipulada a una aplicaci\u00f3n que utiliza cJSON en una plataforma de 32 bits puede causar un desbordamiento de b\u00fafer en la memoria din\u00e1mica, lo que podr\u00eda conducir a la ejecuci\u00f3n remota de c\u00f3digo, la revelaci\u00f3n de informaci\u00f3n o la denegaci\u00f3n de servicio.\n\nDebido a que los intentos de contacto con el creador del proyecto no tuvieron \u00e9xito, la vulnerabilidad solo se ha confirmado en la versi\u00f3n 1.7.19, pero tambi\u00e9n puede afectar a otras versiones."}], "id": "CVE-2026-16554", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16554", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T10:24:13.881075Z", "version": "2.0.3"}}]}, "published": "2026-07-27T09:16:37.383", "references": [{"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/en/posts/2026/07/CVE-2026-16554"}, {"source": "cvd@cert.pl", "tags": ["Product"], "url": "https://github.com/DaveGamble/cJSON"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/07/30/26"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/07/31/4"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{"bugzilla": {"description": "cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON", "id": "2507414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507414"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-131", "details": ["A flaw was found in the cJSON library. On 32-bit platforms, a specially crafted JSON string can cause an integer overflow in the `print_string_ptr()` function. This vulnerability can lead to a heap buffer overflow, which an attacker could exploit to achieve remote code execution, disclose sensitive information, or cause a denial of service."], "mitigation": {"lang": "en:us", "value": "No mitigation is required for Red Hat Enterprise Linux, Red Hat Satellite, or OpenShift Container Platform, as these products are not affected due to their exclusively 64-bit architecture support.\nNo upstream fix is currently available for other affected configurations (for example, cJSON as built for 32-bit architectures in Fedora). As a general precaution, applications using cJSON on a 32-bit platform should avoid processing untrusted JSON input containing very large numbers of control characters within a single string value."}, "name": "CVE-2026-16554", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "impact": "moderate", "package_name": "rpm-ostree", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "moderate", "package_name": "chunkah", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "moderate", "package_name": "rpm-ostree", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "impact": "moderate", "package_name": "cjson", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "impact": "moderate", "package_name": "satellite:el8/cjson", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-07-27T08:40:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16554\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16554\nhttps://cert.pl/en/posts/2026/07/CVE-2026-16554\nhttps://github.com/DaveGamble/cJSON"], "statement": "This flaw is an integer overflow in the print_string_ptr() function of the cJSON library. A 32-bit size_t counter used to track escape characters can wrap around when a JSON string contains approximately 858,993,460 or more control characters, causing an undersized heap buffer to be allocated and subsequently overflowed when the JSON is printed.\nThis issue does not affect the versions of cJSON, or of components that vendor/bundle it (such as rpm-ostree), as shipped with Red Hat Enterprise Linux, Red Hat Satellite, or OpenShift Container Platform. None of these products build or run cJSON, or components embedding it, as 32-bit (i686) binaries: Red Hat Enterprise Linux 7 and later do not support direct installation on or execution as a 32-bit x86 process, the RHEL 8/9 multilib compatibility layer does not include general application libraries such as cJSON, and RHEL 10 removed multilib support entirely. Since the underlying size_t overflow this flaw depends on only manifests on a 32-bit build, the vulnerable condition is not reachable on any architecture these products ship or run on.\nAdditionally, the CVE Numbering Authority (CERT.PL) was unable to reach the cJSON project maintainer during disclosure, and this issue has only been confirmed in cJSON version 1.7.19; no official upstream fix is currently available.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.19"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cJSON", "source": "cna", "vendor": "DaveGamble"}, "product": "cjson", "vendor": "davegamble"}], "created": "2026-07-27T10:30:12.683725+00:00", "updated": "2026-08-05T00:15:04.503027+00:00", "vendors": ["davegamble", "davegamble$PRODUCT$cjson"]}