cJSON versions up to 1.7.19 handle RFC 6902 JSON Patch operations by first detaching and deleting target members before fully validating the operation. When a replace operation lacks a value or a move operation points to an unresolvable destination, the library removes the target member while still returning a failure status from the higher‑level functions. This allows an attacker who can supply the patch document to permanently delete addressable members from the JSON structure, violating the expected all‑or‑nothing behavior and compromising data integrity.

The vulnerability affects any product or system that incorporates DaveGamble cJSON, specifically version 1.7.19 and earlier. This includes open‑source projects, embedded systems, and any application that utilizes cJSON for JSON processing and does not perform additional validation of patch documents.

The CVSS score of 6.9 indicates medium severity, and the EPSS score of less than 1% suggests a very low likelihood of widespread exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, which further indicates limited known exploitation. However, the attack vector is inferred to be through any interface that accepts patch documents—such as REST APIs, configuration update endpoints, or user-supplied files—allowing an attacker to craft a malicious patch that deletes critical data. Once applied, the deletion is permanent even though the API signals a failure, effectively bypassing application‑level integrity checks.