CVE-2026-88369 Details

A buffer overflow vulnerability has been identified in the Zserge Jsmn JSON parser, specifically in the example file 'jsondump.c' from commit 25647e6. The issue arises in non-strict grammar mode, where the parser can emit a token tree that violates Jsmn's own token-size invariant. This flaw allows a STRING or PRIMITIVE token to incorrectly report a size greater than zero, leading the 'dump()' function to recursively access memory out of bounds. The vulnerability has been assigned a medium severity rating, as it can cause information disclosure or a denial-of-service by aborting the parse-walk process.

To address this vulnerability, Jsmn's token-size invariant should be enforced in the parser by ensuring that only container tokens are allowed to have a size increment. Additionally, the 'dump()' function should be made more defensive by checking the size of STRING and PRIMITIVE keys before descending into the token tree.