CVE-2026-87933: DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtilsMergePatch of the file cJSONUtils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DaveGamble cJSONto a version that resolves this vulnerability.Fixed in 1.7.19
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using DaveGamble cJSON versions up to and including 1.7.19 are affected when they use cJSONUtils_MergePatch in cJSON_Utils.c.
Can this be exploited remotely without credentials or user interaction?
The supplied severity vector indicates network attack access, low attack complexity, no privileges required, and no user interaction. The vulnerability description also states that an attack may be launched remotely.
Is public exploit information available?
Yes. The vulnerability description states that an exploit has been made public and could be used.
Is a vendor fix available?
A pull request intended to fix the issue exists, but it is awaiting acceptance. The provided data does not identify an accepted fixed release.