CVE-2026-87933

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87933.json"
}

References

Affected packages

Git / github.com/davegamble/cjson

Affected ranges

Type

GIT

Repo

https://github.com/davegamble/cjson

Events

Introduced

984dc85a5f90e5fa2ec98f15db8ad96613c543b6

Last Affected

c859b25da02955fef659d658b8f324b5cde87be3

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.7.0"
        },
        {
            "last_affected": "1.7.0"
        },
        {
            "introduced": "1.7.1"
        },
        {
            "last_affected": "1.7.1"
        },
        {
            "introduced": "1.7.2"
        },
        {
            "last_affected": "1.7.2"
        },
        {
            "introduced": "1.7.3"
        },
        {
            "last_affected": "1.7.3"
        },
        {
            "introduced": "1.7.4"
        },
        {
            "last_affected": "1.7.4"
        },
        {
            "introduced": "1.7.5"
        },
        {
            "last_affected": "1.7.5"
        },
        {
            "introduced": "1.7.6"
        },
        {
            "last_affected": "1.7.6"
        },
        {
            "introduced": "1.7.7"
        },
        {
            "last_affected": "1.7.7"
        },
        {
            "introduced": "1.7.8"
        },
        {
            "last_affected": "1.7.8"
        },
        {
            "introduced": "1.7.9"
        },
        {
            "last_affected": "1.7.9"
        },
        {
            "introduced": "1.7.10"
        },
        {
            "last_affected": "1.7.10"
        },
        {
            "introduced": "1.7.11"
        },
        {
            "last_affected": "1.7.11"
        },
        {
            "introduced": "1.7.12"
        },
        {
            "last_affected": "1.7.12"
        },
        {
            "introduced": "1.7.13"
        },
        {
            "last_affected": "1.7.13"
        },
        {
            "introduced": "1.7.14"
        },
        {
            "last_affected": "1.7.14"
        },
        {
            "introduced": "1.7.15"
        },
        {
            "last_affected": "1.7.15"
        },
        {
            "introduced": "1.7.16"
        },
        {
            "last_affected": "1.7.16"
        },
        {
            "introduced": "1.7.17"
        },
        {
            "last_affected": "1.7.17"
        },
        {
            "introduced": "1.7.18"
        },
        {
            "last_affected": "1.7.18"
        },
        {
            "introduced": "1.7.19"
        },
        {
            "last_affected": "1.7.19"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.7.0

1.7.1

1.7.10

1.7.11

1.7.12

1.7.13

1.7.14

1.7.15

1.7.16

1.7.17

1.7.18

1.7.19

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

v1.*

v1.7.0

v1.7.1

v1.7.10

v1.7.11

v1.7.12

v1.7.13

v1.7.14

v1.7.15

v1.7.16

v1.7.17

v1.7.18

v1.7.19

v1.7.2

v1.7.3

v1.7.4

v1.7.5

v1.7.6

v1.7.7

v1.7.8

v1.7.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87933.json"