Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-87933

DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.3 HIGHCVSS 3.0 7.3 HIGHCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-87933

Published

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-87933

Published

cJSON

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "DaveGamble",
                    "product": "cJSON",
                    "versions": [
                        {
                            "version": "1.7.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.1",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.2",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.3",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.4",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.5",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.6",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.7",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.8",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.9",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.10",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.11",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.12",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.13",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.14",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.15",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.16",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.17",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.18",
                            "status": "affected"
                        },
                        {
                            "version": "1.7.19",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON