Intel

AIKIDO-2026-10453

open-source-parsers.jsoncpp is vulnerable to Use After Free

Use After Free Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Apr 2, 2026

72

High Risk

This Affects:

C++open-source-parsers.jsoncpp
0.0.1 - 1.9.6
Fixed in 1.9.7
Are you affected? Scan for Free

TL;DR

The Reader::parse(std::istream&) overload read the stream into a local std::string, then forwarded pointers into that buffer to parse(const char*, const char*), which stored them in begin_ / end_. After parse returned, the local string was destroyed while the reader could still hold those pointers. Calling getFormattedErrorMessages() afterward could read freed memory. The fix reads the stream into the member document_ so the buffer lifetime matches the reader, consistent with parse(const std::string&).

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

open-source-parsers.jsoncpp is vulnerable to Use After Free in versions 0.0.1 - 1.9.6.

How to fix this

Upgrade the open-source-parsers.jsoncpp library to the patch version.