On Thu, 30 Jul 2026 at 12:26:25 -0700, Collin Funk wrote:
Alan Coopersmith <[email protected]> writes:
https://cert.pl/en/posts/2026/07/CVE-2026-16554/ appears to cover
an unrelated vulnerability also disclosed this week.
Does anyone actually use platforms with 32-bit size_t? I guess maybe
some programs compiled for 32-bit x86 but run on x86_64?
Yes, people still compile and use i386 libraries on x86_64 systems to
run legacy i386 binaries. On open-source OSs, in practice this mostly
means proprietary games that were never ported to x86_64, like Portal
(but could also mean e.g. firmware updaters, printer drivers, installers).
I happen to know that cJSON is used in at least some libraries that are
relevant to the gaming use-case (GLVND and Vulkan-Loader), although any
security issues in cJSON are hopefully not relevant for those libraries
because they only parse trusted JSON: if an attacker was able to edit
the JSON manifests describing EGL and Vulkan drivers, they'd be able to
load arbitrary code into applications anyway.
smcv
