CVE-2016-10749

CVE-2016-10749 describes a critical buffer over-read vulnerability in the parse_string function of cJSON.c, affecting cJSON versions prior to 2016-10-02. This flaw allows an attacker to read beyond the intended buffer when processing malformed JSON strings starting with " and ending with \, potentially leading to information disclosure or denial of service. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction, enabling high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, publicly available exploit code in common frameworks like Metasploit or Nuclei, or significant community discussion or media coverage.