Integer overflow in Davegamble Cjson
CVE-2026-16554
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993…
Vulnerability class: Integer Overflow
Affected products
- Davegamble Cjson — versions 1.7.19
Weakness classification (CWE)
References
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (product)