An incorrectly resolved abstract name in the decode_pointer_inplace function causes JSON Patch operations to target the wrong object keys when paths contain the RFC 6902 escape sequences ~0 or ~1. Attackers who can supply crafted JSON Patch documents can silently corrupt or delete unintended data fields in applications that utilize cJSONUtils_ApplyPatches or the case‑sensitive variant. This can lead to integrity violations and potential bypass of application‑level authorization controls that rely on key ownership for data modification. The likely attack vector is through any interface that accepts JSON Patch, such as HTTP APIs or configuration endpoints, and requires only unauthenticated submission of a malicious payload.

DaveGamble’s cJSON library versions 1.5.0 through 1.7.19 are affected. Any application built with these releases that invokes cJSONUtils_ApplyPatches or cJSONUtils_ApplyPatchesCaseSensitive for processing JSON Patch requests is vulnerable, including web services, configuration managers, or other tools that rely on cJSON for JSON manipulation.

The CVSS score of 8.7 indicates a high severity vulnerability, while the EPSS score of < 1% suggests a low probability of widespread exploitation at present. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires only the ability to send a malicious RFC 6902 JSON Patch document, which can be done remotely via standard input channels. Because the flaw permits silent data corruption without authentication, the impact on integrity is significant, though the low EPSS means the overall risk is moderate until an attacker targets a wider audience.