cJSON contains an integer overflow (CWE‑131/CWE‑190) in the print_string_ptr() function that happens only on 32‑bit platforms when processing JSON strings with a large number of control characters. The overflow causes an underestimate of the buffer size needed for cJSON_PrintBuffered(), and the subsequent write loop overflows the heap. An attacker who can supply a crafted JSON payload to an application that uses cJSON may exploit this overflow, leading to remote code execution, information disclosure or denial of service.

The vendor DaveGamble’s cJSON library is affected. Version 1.7.19 is confirmed vulnerable and other releases built for 32‑bit environments are likely impacted. The flaw does not apply to 64‑bit builds, where the sizeof(size_t) arithmetic does not overflow.

The CVSS score is 5.1, indicating moderate severity, while the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote or local: an untrusted program or network interface that parses JSON with cJSON can trigger the vulnerability. Exploitation requires a 32‑bit environment and use of cJSON_PrintBuffered() with a pre‑allocated buffer, conditions commonly found in embedded or legacy software.