High severity · published Sep 10, 2026
CVE-2026-87933
DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CJ
cJSON · DaveGamble
1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +14 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87933
github.com
https://github.com/DaveGamble/cJSON/
github.com
https://github.com/DaveGamble/cJSON/issues/1060
github.com
https://github.com/DaveGamble/cJSON/pull/1065
vuldb.com
https://vuldb.com/cve/CVE-2026-87933
vuldb.com
https://vuldb.com/submit/911136
vuldb.com
https://vuldb.com/vuln/401815
More from cJSON
9.8
CVE-2025-57052
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking…
9.8
CVE-2019-11835
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments
9.8
CVE-2019-11834
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal
9.8
CVE-2016-10749
parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character
9.8
CVE-2018-1000217
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE