DEBIAN-CVE-2026-16554
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.
DEBIAN-CVE-2026-16554
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-16554
cjson
Source reference: /affected/0/package/name
- Affected versions
- 1.7.15-1
Source reference:
/affected/0/versions1.7.15-1+deb12u1Source reference:
/affected/0/versions1.7.15-1+deb12u2Source reference:
/affected/0/versions1.7.15-1+deb12u3Source reference:
/affected/0/versions1.7.15-1+deb12u4Source reference:
/affected/0/versions1.7.16-1Source reference:
/affected/0/versions1.7.16-2Source reference:
/affected/0/versions1.7.17-1Source reference:
/affected/0/versions1.7.17-2Source reference:
/affected/0/versions1.7.18-1Source reference:
/affected/0/versions1.7.18-2Source reference:
/affected/0/versions1.7.18-3Source reference:
/affected/0/versions1.7.18-3.1Source reference:
/affected/0/versions1.7.18-4Source reference:
/affected/0/versions1.7.19-1Source reference:
/affected/0/versions1.7.19-2Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
cjson
Source reference: /affected/1/package/name
- Affected versions
- 1.7.18-3.1
Source reference:
/affected/1/versions1.7.18-3.1+deb13u1Source reference:
/affected/1/versions1.7.18-4Source reference:
/affected/1/versions1.7.19-1Source reference:
/affected/1/versions1.7.19-2Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
cjson
Source reference: /affected/2/package/name
- Affected versions
- 1.7.18-3.1
Source reference:
/affected/2/versions1.7.18-4Source reference:
/affected/2/versions1.7.19-1Source reference:
/affected/2/versions1.7.19-2Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cjson",
"purl": "pkg:deb/debian/cjson?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.7.15-1",
"1.7.15-1+deb12u1",
"1.7.15-1+deb12u2",
"1.7.15-1+deb12u3",
"1.7.15-1+deb12u4",
"1.7.16-1",
"1.7.16-2",
"1.7.17-1",
"1.7.17-2",
"1.7.18-1",
"1.7.18-2",
"1.7.18-3",
"1.7.18-3.1",
"1.7.18-4",
"1.7.19-1",
"1.7.19-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-16554.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cjson",
"purl": "pkg:deb/debian/cjson?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.7.18-3.1",
"1.7.18-3.1+deb13u1",
"1.7.18-4",
"1.7.19-1",
"1.7.19-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-16554.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cjson",
"purl": "pkg:deb/debian/cjson?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.7.18-3.1",
"1.7.18-4",
"1.7.19-1",
"1.7.19-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-16554.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55552 · Revision 1
- Added to Heist Feed
- Publisher date