Attack Chain

1. An attacker prepares a malicious RFC 6902 JSON Patch document containing add and copy operations designed to duplicate and graft subtrees.
2. The attacker submits this malicious JSON Patch to an application that uses the vulnerable cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() functions.
3. The cJSON library applies the patch, creating a JSON document with an excessively deep structure, exceeding the parser's 1000-level nesting limit and potentially the CJSON_CIRCULAR_LIMIT (10000).
4. When the application later attempts to free the malformed JSON document using cJSON_Delete(), the function initiates an uncontrolled recursive traversal.
5. The unbounded recursion within cJSON_Delete() causes the application's thread stack to exhaust.
6. The stack exhaustion leads to an application crash.
7. The application becomes unavailable, resulting in a denial-of-service condition for legitimate users.

Impact

Successful exploitation of CVE-2026-67215 results in a denial-of-service condition for applications utilizing the vulnerable cJSON library (versions through 1.7.19). An attacker can crash the target process by supplying a crafted JSON Patch, rendering the service or application inaccessible. While no specific victim counts or targeted sectors are mentioned, any application processing untrusted RFC 6902 JSON Patches with affected cJSON versions is susceptible to this availability impact.

Recommendation

1. Upgrade the cJSON library to a version patched against CVE-2026-67215 immediately.
2. Implement robust input validation and sanitization for all incoming RFC 6902 JSON Patch documents to prevent malicious structures from being processed by cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive().
3. Monitor application logs for sudden process crashes or stack overflow errors, which could indicate attempted exploitation of CVE-2026-67215.