CVE-2016-4303

Critical

Published: 26/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The parse_string function in the cJSON library mishandles UTF8/16 strings, allowing remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, triggering a heap-based buffer overflow.

Risk Assessment

This vulnerability can lead to serious availability issues and allow attackers to execute malicious code, posing a threat to data integrity and confidentiality.

Recommendation

It is recommended to update the cJSON library to the latest version that fixes this vulnerability and to conduct a code audit to identify potential attack vectors.

Original NVD description (English source)

The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.