{"id":"CVE-2016-10749","details":"parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a \" character and ends with a \\ character.","modified":"2026-08-07T14:48:25.654090Z","published":"2019-04-29T14:29:00.363Z","references":[{"type":"FIX","url":"https://github.com/DaveGamble/cJSON/commit/94df772485c92866ca417d92137747b2e3b0a917"},{"type":"FIX","url":"https://github.com/DaveGamble/cJSON/issues/30"},{"type":"FIX","url":"https://www.openwall.com/lists/oss-security/2016/11/07/2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/davegamble/cjson","events":[{"introduced":"0"},{"fixed":"0d10e279c8b604f71829b5d49d092719f4ae96b6"},{"fixed":"94df772485c92866ca417d92137747b2e3b0a917"}],"database_specific":{"cpe":"cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.0.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10749.json","vanir_signatures_modified":"2026-08-07T14:48:25Z","vanir_signatures":[{"source":"https://github.com/davegamble/cjson/commit/0d10e279c8b604f71829b5d49d092719f4ae96b6","target":{"file":"cJSON.c"},"deprecated":false,"digest":{"line_hashes":["214509248559649542150322052439560154578","110701872533830851366985102286714198017","142488731430175457374910759457462576535","55921998459652784669763853962360756393"],"threshold":0.9},"id":"CVE-2016-10749-38756e57","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"313291815028565380101178937570426080306","length":1832},"id":"CVE-2016-10749-432deb63","signature_type":"Function","signature_version":"v1","source":"https://github.com/davegamble/cjson/commit/94df772485c92866ca417d92137747b2e3b0a917","target":{"file":"cJSON.c","function":"parse_string"}},{"id":"CVE-2016-10749-61c5e3f8","signature_type":"Function","signature_version":"v1","source":"https://github.com/davegamble/cjson/commit/0d10e279c8b604f71829b5d49d092719f4ae96b6","target":{"file":"cJSON.c","function":"cJSON_ReplaceItemInObject"},"deprecated":false,"digest":{"function_hash":"1300442375208066380257833188008827735","length":293}},{"deprecated":false,"digest":{"line_hashes":["24552215036129687395244833755228104358","162022706810946277969604945826989173380","208374190646583187667077711122692868183","298101489441346728946409594084335467750"],"threshold":0.9},"id":"CVE-2016-10749-b7aaf924","signature_type":"Line","signature_version":"v1","source":"https://github.com/davegamble/cjson/commit/94df772485c92866ca417d92137747b2e3b0a917","target":{"file":"cJSON.c"}}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}