CVE-2026-67217

A flaw was found in cJSON. The library applies RFC 6902 JSON Patch operations non-atomically. A remote attacker, by supplying a specially crafted patch document (e.g., a 'replace' operation missing its value or a 'move' operation with an unresolved destination), can cause the existing target data to be detached and deleted before the operation is fully validated. This leads to data destruction within the target document, even if the API reports that the patch failed, thereby defeating the expected all-or-nothing behavior.

This flaw affects cJSON's optional JSON Patch (RFC 6902) support, found in the cJSON Utilities module. If a patch document contains a malformed replace operation (missing its value) or a move operation with an unresolvable destination, the library removes the target member before finishing validation of the patch. The library reports the patch as failed, but the document has already been changed. Only software that builds the cJSON Utilities module and passes it externally supplied patch documents is affected. No fixed release of cJSON is currently available.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.