Description

A vulnerability has been found in armink struct2json 1.0. This affects the function S2J_STRUCT_GET_string_ELEMENT in the library struct2json/inc/s2jdef.h of the component JSON Deserialization. The manipulation of the argument valuestring leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T16:19:19.507Z",
  "pubdate": "2026-08-31T16:19:19.507Z",
  "executiveSummary": "A null pointer dereference vulnerability exists in the armink struct2json library, specifically within version 1.0. The vulnerability is located in the S2J_STRUCT_GET_string_ELEMENT function defined in struct2json/inc/s2jdef.h.\nThe flaw allows an attacker to trigger a crash or potentially achieve remote code execution by manipulating the valuestring argument during JSON deserialization processes. Because this library is commonly used in embedded systems for data parsing, the impact is significant, potentially leading to denial-of-service conditions or system instability.\nThe vulnerability is remotely exploitable, requiring no specific authentication or elevated privileges beyond the ability to supply crafted input to the target component. The public disclosure of the exploit increases the risk of exploitation. As the vendor has not responded to inquiries or provided a patch, users of the library are currently exposed to this risk with limited remediation options.",
  "technicalDetails": "The vulnerability resides in the S2J_STRUCT_GET_string_ELEMENT function within the struct2json/inc/s2jdef.h file. This function is responsible for extracting string elements from a JSON object and mapping them to a corresponding C structure field. The root cause is an improper handling of the valuestring pointer during the deserialization flow.\nIn the affected component, the logic fails to validate the outcome of cJSON string extraction before dereferencing the pointer. When the function expects a valid string element within the JSON payload, it invokes the underlying cJSON primitives to extract the value. If a malformed or specifically crafted JSON input is provided where the target element is missing or intentionally nullified, the cJSON parser may return a NULL pointer for the valuestring field. The S2J_STRUCT_GET_string_ELEMENT function subsequently attempts to access or copy memory from this NULL address without prior verification, triggering an immediate null pointer dereference.\nThe attack flow begins with the delivery of a malicious JSON payload to an interface utilizing struct2json for data processing. An attacker can initiate this remotely by intercepting or providing data to the input parser. When the library parses the attacker-controlled input, the lack of input sanitization leads the application into an insecure state. Step-by-step, the exploitation occurs as follows: 1) The application initializes a JSON object parsing routine. 2) The attacker submits a JSON object missing the required string element or containing an invalid key-value structure that forces the parser to return a NULL pointer. 3) The execution enters S2J_STRUCT_GET_string_ELEMENT. 4) The function fails to perform a null-check on the retrieved pointer. 5) The program execution flow dereferences the NULL address, causing a segmentation fault or memory access violation.\nThe post-exploitation impact is primarily a denial-of-service, as the application process will crash upon dereferencing the NULL pointer. However, depending on the memory layout and the presence of exploit mitigation techniques such as SMEP or SMAP in embedded environments, advanced attackers might attempt to leverage this primitive for control-flow hijacking if the underlying architecture permits memory mapping at the NULL base address. Given the nature of the library's role in deserialization, this vulnerability provides a vector for remote crashes on any device or software component utilizing armink struct2json 1.0."
}