CVE-2026-82803 Overview
CVE-2026-82803 is a null pointer dereference vulnerability in the armink/struct2json library version 1.0. The flaw resides in the S2J_STRUCT_GET_string_ELEMENT macro defined in struct2json/inc/s2jdef.h, which is part of the JSON deserialization component. Attackers can trigger the condition by manipulating the valuestring argument during JSON parsing, causing a null pointer dereference [CWE-404]. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. Applications embedding struct2json to deserialize untrusted JSON input are exposed to denial-of-service conditions.
Critical Impact
Remote attackers can crash any application that uses struct2json to deserialize attacker-controlled JSON, resulting in a denial-of-service condition against the affected process.
Affected Products
- armink struct2json version 1.0
- Applications embedding the struct2json library for JSON deserialization
- Downstream projects that link s2jdef.h and expose JSON parsing to untrusted input
Discovery Timeline
- 2026-08-31 - CVE-2026-82803 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-82803
Vulnerability Analysis
The vulnerability affects struct2json, a lightweight C library that converts between C structures and JSON objects using cJSON. During deserialization, the S2J_STRUCT_GET_string_ELEMENT macro extracts a valuestring field from a parsed cJSON object and assigns or copies it into a destination structure. The macro does not verify that valuestring is non-NULL before dereferencing it. When a JSON payload contains a string field whose value is null, a non-string type, or a malformed entry, cJSON leaves valuestring as NULL. Any subsequent read or strcpy-style operation on that pointer crashes the host process.
Because deserialization is often exposed at input boundaries such as network listeners, IPC handlers, and configuration loaders, an unauthenticated remote attacker can transmit a crafted JSON document to trigger the fault. The impact is limited to availability of the affected process; there is no direct memory disclosure or code execution path.
Root Cause
The root cause is missing input validation on the valuestring member returned by the JSON parser. The S2J_STRUCT_GET_string_ELEMENT macro assumes that string elements are always present and non-null, violating defensive programming practices around untrusted input. This class of defect is captured by CWE-404: Improper Resource Shutdown or Release, reflecting improper handling of parser state.
Attack Vector
An attacker sends a JSON document to any interface backed by struct2json deserialization. The document either omits an expected string field, sets it to JSON null, or supplies a non-string type. When the macro dereferences the resulting NULLvaluestring, the process terminates. No authentication or user interaction is required when the parser is exposed over the network.
A public proof-of-concept is available in the GitHub PoC Repository, and the full write-up is published in the GitHub Security Advisory. Additional details are tracked at VulDB CVE-2026-82803.
Detection Methods for CVE-2026-82803
Indicators of Compromise
- Unexpected process crashes or segmentation faults in services that ingest JSON via struct2json
- Core dumps referencing s2jdef.h, S2J_STRUCT_GET_string_ELEMENT, or cJSON_GetObjectItem in the stack trace
- Repeated malformed JSON requests from a single source correlated with service restarts
Detection Strategies
- Perform source-level review to identify uses of S2J_STRUCT_GET_string_ELEMENT and confirm whether callers validate JSON input before invocation
- Fuzz JSON-facing endpoints with payloads that set string fields to null or omit them to reproduce the crash under controlled conditions
- Monitor application logs and crash telemetry for repeated aborts tied to JSON deserialization code paths
Monitoring Recommendations
- Alert on abnormal restart rates for services that embed struct2json
- Capture and centralize crash reports, including stack traces, to a data lake for correlation with inbound request patterns
- Track inbound JSON payload anomalies such as unexpected null string fields at API gateways or reverse proxies
How to Mitigate CVE-2026-82803
Immediate Actions Required
- Inventory all software that links against armink/struct2json 1.0 and identify network-exposed deserialization paths
- Introduce a validation wrapper around S2J_STRUCT_GET_string_ELEMENT that checks valuestring for NULL before use
- Restrict access to JSON-parsing endpoints to trusted sources until a code-level fix is deployed
Patch Information
No vendor patch is available. According to the disclosure, the maintainer did not respond to the reporter. Downstream consumers should apply an in-tree fix that null-checks valuestring prior to dereference or replace the macro with a safe helper function. Refer to the GitHub Security Advisory for the disclosed technical details.
Workarounds
- Pre-validate incoming JSON with a schema validator that rejects null or missing string fields before invoking struct2json
- Wrap deserialization calls in fault-tolerant boundaries so that a crash does not affect other tenants or sessions
- Rate-limit and authenticate JSON endpoints to reduce exposure to unauthenticated remote requests
- Consider forking struct2json locally and adding NULL checks to s2jdef.h macros until an upstream fix appears
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
