Medium [CVE-2026-16554] Remote code execution due to integer overflow via crafted JSON
This medium-severity Red Hat Linux advisory covers CVE-2026-16554.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Red Hat Linux publishes the next one.
See Red Hat Linux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length.
When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.
Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions. This issue does not affect the versions of cJSON, or of components that vendor/bundle it (such as rpm-ostree), as shipped with Red Hat Enterprise Linux, Red Hat Satellite, or OpenShift Container Platform.
- 1.7.19
Official advisory · high-confidence parse· fetched 28 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists. Confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 28 days ago·verify at source
Mitigation checklist
- No mitigation is required for Red Hat Enterprise Linux, Red Hat Satellite, or OpenShift Container Platform, as these products are not affected due to their exclusively 64-bit architecture support. No upstream fix is currently available for other affected configurations (for example, cJSON as built for 32-bit architectures in Fedora). As a general precaution, applications using cJSON on a 32-bit platform should avoid processing untrusted JSON input containing very large numbers of control characters within a single string value.
Official advisory · high-confidence parse· fetched 28 days ago·verify at source
More Red Hat Linux advisories
- CVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-free
- CVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
- CVE-2026-97229Oct 13, 2026integer overflow issue in CI/CD regular expression compiler
- CVE-2026-64849Aug 17, 2026Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed
- CVE-2026-53362Jul 4, 2026account for fraggap on the paged allocation path
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.