The flaw resides in the JsonMergePatch.fromJson function of the json-patch library (up to version 1.13). A crafted JSON merge patch payload causes a stack-based buffer overflow in JsonMergePatchDeserializer.java. This overflow can lead to control‑flow hijacking or memory corruption, enabling an attacker to execute arbitrary code or crash the application. The vulnerability is classed as a buffer overflow (CWE‑119) and stack buffer overflow (CWE‑121).

The affected product is java-json-tools’ json-patch library, versions up to and including 1.13. No other vendors or products are listed, and the CPE specification cites this library specifically.

The CVSS score of 6.9 indicates significant severity, and the exploit has already been published, suggesting real‑world use. The EPSS score is not provided, but the existence of a public exploit and the ability to attack remotely point to a non‑negligible risk of actual exploitation. Because the library is open source and likely used by many projects that process external JSON data, organizations that employ it are at risk of remote code execution if the flaw remains unpatched.