Buffer Overflow in jsmn via example/jsondump.c

Executive Summary

CVE-2026-88369 is a buffer overflow vulnerability in the jsmn JSON parser library. It occurs in the dump() function of example/jsondump.c when processing malformed JSON input. The issue stems from non-strict parsing allowing STRING or PRIMITIVE tokens to have a size greater than zero, violating jsmn's invariant. The dump() function incorrectly assumes such tokens have child tokens, leading to out-of-bounds memory access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, use AddressSanitizer (ASan) to compile and run the jsmn library with the example code. Test with a malformed JSON input that triggers the non-strict parsing behavior. If a heap-buffer-overflow is detected, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to read sensitive memory or cause denial-of-service by crashing the application. It may lead to information disclosure if exploited with crafted JSON input. Systems using jsmn in non-strict parsing mode are particularly at risk.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately switch to strict grammar mode by compiling jsmn with -DJSMN_STRICT=1. Update the dump() function in jsondump.c to validate token types and bounds before memory access. Avoid using non-strict parsing for untrusted JSON inputs.

Useful 0 Not Useful 0