CVE-2026-16554 is an integer overflow vulnerability in the cJSON library's print_string_ptr() function on 32-bit platforms. The vulnerability arises because the escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters. This wraparound causes the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop can overflow the heap allocation. This heap buffer overflow can be triggered by an attacker supplying a crafted JSON string, potentially leading to remote code execution, information disclosure, or denial of service. The vulnerability has been confirmed in version 1.7.19, but other versions may also be affected. Attempts to contact the project creator were unsuccessful, and no patch or remediation guidance is currently available.

Exploitation of this vulnerability can lead to heap buffer overflow on 32-bit platforms using cJSON version 1.7.19. This may result in remote code execution, information disclosure, or denial of service. The vulnerability requires an attacker to supply a specially crafted JSON string containing a very large number of control characters. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since attempts to contact the project creator were unsuccessful and no official fix is available, users should consider avoiding use of cJSON version 1.7.19 on 32-bit platforms or implement additional input validation to limit the size and content of JSON strings processed. Monitor vendor channels for any future patches or updates addressing this issue.