The vulnerability in cJSON (CVE-2026-29036) affects versions 1.5.0 through 1.7.19 and involves incorrect resolution of JSON Pointer escape sequences (~0 or ~1) in the decode_pointer_inplace() function within cJSON_Utils.c. This flaw allows unauthenticated attackers to craft JSON Patch inputs that cause patch operations to apply to wrong object keys. Applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() can be exploited to silently corrupt data or delete unintended keys, potentially bypassing authorization mechanisms that depend on JSON Patch for controlled data modification.

Attackers can submit malicious JSON Patch inputs that exploit the incorrect pointer resolution to modify or delete unintended data keys silently. This can lead to unauthorized data manipulation and bypass of authorization controls in affected applications. The vulnerability is exploitable remotely without authentication and has a high severity score (CVSS 8.7).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should avoid using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() with untrusted input or implement additional validation of JSON Patch inputs to prevent exploitation.