CVE-2026-87933

EUVD-2026-75225
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.86%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
davegamblecjson
1.7.0
CNA
davegamblecjson
1.7.1
CNA
davegamblecjson
1.7.2
CNA
davegamblecjson
1.7.3
CNA
davegamblecjson
1.7.4
CNA
davegamblecjson
1.7.5
CNA
davegamblecjson
1.7.6
CNA
davegamblecjson
1.7.7
CNA
davegamblecjson
1.7.8
CNA
davegamblecjson
1.7.9
CNA
davegamblecjson
1.7.10
CNA
davegamblecjson
1.7.11
CNA
davegamblecjson
1.7.12
CNA
davegamblecjson
1.7.13
CNA
davegamblecjson
1.7.14
CNA
davegamblecjson
1.7.15
CNA
davegamblecjson
1.7.16
CNA
davegamblecjson
1.7.17
CNA
davegamblecjson
1.7.18
CNA
davegamblecjson
1.7.19
CNA
Debian logo
Debian Releases
Debian Product
Codename
cjson
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cjson
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/DaveGamble/cJSON/
https://github.com/DaveGamble/cJSON/issues/1060
https://github.com/DaveGamble/cJSON/pull/1065
https://vuldb.com/cve/CVE-2026-87933
https://vuldb.com/submit/911136
https://vuldb.com/vuln/401815
https://vuldb.com/vuln/401815/cti