CVE-2026-86318: Stack-based Buffer Overflow in java-json-tools json-patch

The vulnerability CVE-2026-86318 exists in the java-json-tools json-patch library up to version 1.13. It is a stack-based buffer overflow in the JsonMergePatch.fromJson function of the JsonMergePatchDeserializer.java file. This flaw allows remote attackers to cause a buffer overflow by sending crafted input to the affected function. The vulnerability does not require privileges, user interaction, or confidentiality/integrity/availability impact beyond limited availability impact. The exploit code has been published, but the vendor has not yet issued a fix or official response.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, potentially allowing an attacker to crash the application or execute arbitrary code remotely. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to systems using affected versions of the json-patch library. However, the CVSS vector indicates no impact on confidentiality, integrity, or availability beyond limited availability impact, suggesting the primary impact is denial of service or limited code execution.

No official fix or patch is currently available from the vendor, and the project has not responded to the issue report. Users should monitor the vendor's channels for updates and consider applying workarounds such as input validation or restricting access to services using the vulnerable library until a patch is released. Due to the exploit being publicly available, heightened vigilance is recommended.