CVE-2026-16554

{"id": "CVE-2026-16554", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16554", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T10:24:13.881075Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/DaveGamble/cJSON", "vendor": "DaveGamble", "modules": ["cJSON.c"], "product": "cJSON", "versions": [{"status": "affected", "version": "1.7.19", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-27T09:16:37.383", "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-16554", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://github.com/DaveGamble/cJSON", "tags": ["Product"], "source": "cvd@cert.pl"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/30/26", "tags": ["Issue Tracking", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/31/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."}, {"lang": "es", "value": "La biblioteca cJSON es vulnerable a un desbordamiento de entero en la funci\u00f3n print_string_ptr() en cJSON.c en plataformas de 32 bits. El contador escape_characters, un size_t de 32 bits, puede desbordarse al procesar cadenas que contienen aproximadamente 858,993,460 o m\u00e1s caracteres de control, lo que provoca que el b\u00fafer de salida se asigne bas\u00e1ndose en una longitud subestimada. Cuando se utiliza cJSON_PrintBuffered() con un b\u00fafer preasignado, el bucle de escritura posterior desborda la asignaci\u00f3n de memoria din\u00e1mica. Un atacante que proporciona una cadena JSON manipulada a una aplicaci\u00f3n que utiliza cJSON en una plataforma de 32 bits puede causar un desbordamiento de b\u00fafer en la memoria din\u00e1mica, lo que podr\u00eda conducir a la ejecuci\u00f3n remota de c\u00f3digo, la revelaci\u00f3n de informaci\u00f3n o la denegaci\u00f3n de servicio.\n\nDebido a que los intentos de contacto con el creador del proyecto no tuvieron \u00e9xito, la vulnerabilidad solo se ha confirmado en la versi\u00f3n 1.7.19, pero tambi\u00e9n puede afectar a otras versiones."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:davegamble:cjson:1.7.19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FE04ECA-71CF-4F94-86DD-3F2936568058"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}