USN-8189-1: RapidJSON vulnerability

USN-8189-1: RapidJSON vulnerability

Publication date: 20 April 2026
Overview: RapidJSON could be made to crash or run programs as an administrator if it opened a specially crafted file.

Packages

• rapidjson - A fast JSON parser/generator for C++

Details
It was discovered that RapidJSON did not properly protect against integer
overflows in certain instances when parsing JSON text. A remote attacker
could possibly use this issue to craft a malicious JSON file, that when
read by RapidJSON, would lead to an elevation of privilege, resulting in
the potential disclosure of sensitive information.

Update instructions
In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

• 24.04 LTS noble rapidjson-dev – 1.1.0+dfsg2-7.2ubuntu0.1~esm2
• 22.04 LTS jammy rapidjson-dev – 1.1.0+dfsg2-7ubuntu0.1~esm2
• 20.04 LTS focal rapidjson-dev – 1.1.0+dfsg2-5ubuntu1+esm2
• 18.04 LTS bionic rapidjson-dev – 1.1.0+dfsg2-3ubuntu0.1~esm2
• 16.04 LTS xenial rapidjson-dev – 0.12~git20141031-3ubuntu0.1~esm2