CVE-2026-87933
published 2026-09-10CVE-2026-87933: A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The…
PriorityP349high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.53%
43.8th percentile
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
| davegamble | cjson | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A vulnerability was found in DaveGamble cJSON up to 1.7.19.
ghsa_unreviewed·2026-09-10
CVE-2026-87933 [MEDIUM] CWE-119 A vulnerability was found in DaveGamble cJSON up to 1.7.19.
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Red Hat
cJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch
vendor_redhat·2026-09-10·CVSS 7.3
CVE-2026-87933 [HIGH] CWE-825 cJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch
cJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch
A flaw was found in DaveGamble cJSON. The `cJSONUtils_MergePatch` function in `cJSON_Utils.c` is vulnerable to a use-after-free error. A remote attacker could exploit this memory corruption vulnerability, potentially leading to information disclosure, data corruption, or denial of service.
Package: rpm-ostree (Red Hat Enterprise Linux 8) - Under investigation
Package: chunkah (Red Hat Hardened Images) - Not affected
Package: rpm-ostree (Red Hat OpenShift Container Platform 4) - Under investigation
Package: cjson (Red Hat Satellite 6) - Under investigation
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-87933 cjson: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch [fedora-all]
bugzilla·2026-09-14·CVSS 7.3
CVE-2026-87933 [HIGH] CVE-2026-87933 cjson: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch [fedora-all]
CVE-2026-87933 cjson: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Bugzilla
CVE-2026-87933 dcm2niix: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch [fedora-all]
bugzilla·2026-09-14·CVSS 7.3
CVE-2026-87933 [HIGH] CVE-2026-87933 dcm2niix: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch [fedora-all]
CVE-2026-87933 dcm2niix: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Bugzilla
CVE-2026-87933 cJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch
bugzilla·2026-09-10·CVSS 7.3
CVE-2026-87933 [HIGH] CVE-2026-87933 cJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch
CVE-2026-87933 cJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
2026-09-10
Published