Buffer Overflow in jsmn JSON Parser

Executive Summary

This is a Buffer Overflow vulnerability in the jsmn library (specifically in the jsmn.h header and jsmn_parse() function). It allows a remote attacker to cause a denial of service by exploiting improper memory handling during JSON parsing.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-95117, compile the jsmn library with AddressSanitizer and run the example program jsondump.c with a malformed JSON input. Use commands like: gcc -fsanitize=address -fno-omit-frame-pointer -DJSMN_STRICT=0 -o jsondump example/jsondump.c && ./jsondump <(echo '{"malformed": "input"}') to trigger potential out-of-bounds reads.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected jsmn library version, an attacker could send maliciously crafted JSON data to crash your application or system, leading to service disruption or potential unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability through denial of service or memory disclosure via out-of-bounds reads. While not directly violating GDPR or HIPAA, it could indirectly affect compliance by enabling attacks that disrupt systems handling personal health or sensitive data, potentially leading to unauthorized access or service disruptions that violate data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update to the patched version of jsmn from pull request #250. If updating is not possible, disable non-strict parsing by compiling with -DJSMN_STRICT=1. Avoid using the example jsondump.c program until patched. Monitor for crashes or memory corruption in applications using jsmn.

Useful 0 Not Useful 0