Heap Buffer Overflow in JSON Parsing via Null Escape

CVE-2026-112021 is a heap-based buffer overflow vulnerability in snac2's JSON lexer that processes ActivityPub POST requests before signature validation. The flaw exists in the _xs_json_load_lexer() function, which fails to properly handle \u0000 escape sequences in JSON strings, leading to heap memory corruption. This vulnerability affects any snac2 instance versions before 2.93 and is particularly critical because attackers need no authentication—a single malicious application/activity+json POST to the activitypub_post_handler() endpoint triggers the overflow, allowing remote attackers to crash the server and potentially achieve code execution. Organizations running snac2 for ActivityPub federation are immediately at risk.

While this CVE maps to CWE-122 (Heap-based Buffer Overflow) rather than specific MITRE ATT&CK techniques, Casky's Claude-powered analysis would detect the exploitation chain through anomalous JSON parsing behaviors and memory corruption patterns. Practitioners leveraging Casky would identify suspicious indicators including: malformed JSON payloads with embedded null byte escapes reaching the activitypub_post_handler(), unexpected process crashes or segmentation faults correlating with JSON POST requests, and heap memory access violations in logs. By correlating these signals with CWE-122 patterns and input validation failures, security teams can detect attacks before they result in denial of service, enabling rapid patching and request filtering strategies.