CVE-2026-82803CWE-404CWE-476

CVE-2026-82803

Medium · published August 31, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

A vulnerability has been found in armink struct2json 1.0. This affects the function S2J_STRUCT_GET_string_ELEMENT in the library struct2json/inc/s2jdef.h of the component JSON Deserialization. The manipulation of the argument valuestring leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00701 · 52.7th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2026-08-31T20:19Z
References (6)
https://github.com/fa1c4/security-advisories/tree/main/struct2json · [email protected]https://github.com/fa1c4/security-advisories/tree/main/struct2json/PoC · [email protected]https://vuldb.com/cve/CVE-2026-82803 · [email protected]https://vuldb.com/submit/858192 · [email protected]https://vuldb.com/vuln/397224 · [email protected]https://vuldb.com/vuln/397224/cti · [email protected]
EPSS history
Timeline
  • 02 SEP 03:40Z
    EPSS moved — → 0%
    epss
  • 31 AUG 15:30Z
    armink struct2json JSON Deserialization s2jdef.h S2J_STRUCT_GET_string_ELEMENT null pointer dereference
    cvelistv5