Integer Overflow in cJSON Can Trigger Heap Overflow and Possible RCE

CERT Polska disclosed CVE-2026-16554, an integer overflow vulnerability in the DaveGamble cJSON library that can lead to a heap buffer overflow on 32-bit platforms. The flaw affects confirmed version 1.7.19 and occurs in the print_string_ptr() function in cJSON.c, where the 32-bit size_t escape_characters counter can wrap while processing extremely large JSON strings containing roughly 858,993,460 or more control characters.

If an application uses cJSON_PrintBuffered() with a pre-allocated buffer, the integer wrap can cause the library to underestimate the required allocation before entering the write loop, creating conditions for memory corruption. CERT Polska said a crafted JSON string supplied to software using cJSON could enable remote code execution, information disclosure, or denial of service; the group coordinated disclosure but said vendor contact attempts were unsuccessful, and only version 1.7.19 has been confirmed vulnerable so far, though other versions may also be affected.