Every CVE Search/ Get API key

CVE-2026-87933

DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free

6.9 Medium

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.53%Up 0.2 points since Sep 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Record
CVE-2026-87933
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 2.0
7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Weakness
CWE-416, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-75225 6.9

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Record
EUVD-2026-75225
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-7jcg-95pj-h5fp 5.5

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function...

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Record
GHSA-7jcg-95pj-h5fp
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 5.5

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Record
CVE-2026-87933
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119, CWE-416
Updated
2026-11-02
OSV 5.5

DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Record
CVE-2026-87933
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-87933 5.5

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Record
DEBIAN-CVE-2026-87933
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-87933 5.5

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Record
UBUNTU-CVE-2026-87933
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVAZL-100911 No score

CVE-2026-87933 affecting package ceph 18.2.2-12

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Record
AZL-100911
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ceph
Azure Linux:3
 through 18.2.2-12 None known
cjson
Debian:12
 All versions, plus listed versions
1.7.15-11.7.15-1+deb12u11.7.15-1+deb12u21.7.15-1+deb12u31.7.15-1+deb12u4
Show 11 moreShow less
1.7.16-11.7.16-21.7.17-11.7.17-21.7.18-11.7.18-21.7.18-31.7.18-3.11.7.18-41.7.19-11.7.19-2
 None known
cjson
Debian:13
 All versions, plus listed versions
1.7.18-3.11.7.18-3.1+deb13u11.7.18-41.7.19-11.7.19-2
 None known
cjson
Debian:14
 All versions, plus listed versions
1.7.18-3.11.7.18-41.7.19-11.7.19-2
 None known
cjson
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.7.10-1.11.7.10-1.1ubuntu0.1~esm1
 None known
cjson
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.7.14-11.7.15-11.7.15-1ubuntu0.1~esm21.7.15-1ubuntu0.11.7.15-1ubuntu0.1+esm1
 None known
cjson
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.7.16-11.7.16-21.7.17-11.7.17-1ubuntu0.1~esm21.7.17-1ubuntu0.1~esm3
 None known
cjson
Ubuntu:26.10
 All versions, plus listed versions
1.7.19-2
 None known
cjson
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.7.18-3.11.7.18-41.7.19-11.7.19-2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-87933 is a medium vulnerability (CVSS 6.9) in Cjson Project Cjson, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. No source names a fixed version.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open