CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c: for a replace operation missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated. An attacker who can supply the patch document sends such a malformed operation and destroys addressable members of the target document even though cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. This defeats the all-or-nothing semantics callers rely on to reject bad patches, causing silent data loss and integrity corruption (CWE-696, incorrect behavior order). Any application, SDK, or firmware embedding an affected cJSON release and using the JSON Patch utility functions with attacker-controlled documents is affected; deployments that only use cJSON for parsing are not impacted. No in-the-wild exploitation is known: a public proof-of-concept write-up exists, EPSS is 0.3% (22nd percentile), the issue is not in CISA KEV, and CVSS 4.0 rates it 6.9 medium.

What to do: Audit builds for cJSON versions 1.7.19 or older and check whether any code path calls cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() with attacker-supplied patch documents, then upgrade to a cJSON release newer than 1.7.19 once upstream publishes a fix. Until patched, pre-validate patches (reject replace operations lacking a value member and move operations with unresolvable destination paths), or treat any failure return from the patch API as 'document may have been partially modified' rather than assuming atomicity.