Critical severity9.8NVD Advisory· Published Sep 26, 2016· Updated May 6, 2026
CVE-2016-4303
CVE-2016-4303
Description
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- github.com/esnet/iperf/commit/91f2fa59e8ed80dfbf400add0164ee0e508e412anvdPatchThird Party Advisory
- blog.talosintel.com/2016/06/esnet-vulnerability.htmlnvdExploitThird Party Advisory
- www.talosintelligence.com/reports/TALOS-2016-0164/nvdExploitThird Party Advisory
- lists.opensuse.org/opensuse-updates/2016-08/msg00082.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2016-08/msg00090.htmlnvdMailing ListThird Party Advisory
- software.es.net/iperf/news.htmlnvdRelease NotesThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/01/msg00023.htmlnvdMailing ListThird Party Advisory
- raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.ascnvdThird Party Advisory
News mentions
0No linked articles in our index yet.