CVE-2026-82803: NULL Pointer Dereference in armink struct2json

This vulnerability affects armink struct2json version 1.0 in the JSON deserialization component, specifically the function S2J_STRUCT_GET_string_ELEMENT located in struct2json/inc/s2jdef.h. The issue is caused by improper manipulation of the 'valuestring' argument, leading to a null pointer dereference. This can be triggered remotely without authentication or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The vendor was notified but has not issued any response or patch. Exploit details have been publicly disclosed, but no known exploits in the wild have been reported.

The vulnerability can cause a null pointer dereference, which typically results in application crashes or denial of service conditions. Since it can be triggered remotely without privileges or user interaction, it may allow attackers to disrupt services relying on the affected library. There is no indication of code execution or data corruption beyond denial of service.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's channels for updates. Until a fix is provided, consider applying workarounds such as input validation or isolating the affected component to mitigate potential denial of service impacts. Avoid using version 1.0 of struct2json in security-critical environments if possible.