CVE-2026-87933CWE-119CWE-416

CVE-2026-87933

High · published September 10, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00527 · 43.8th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-416 · Use After Free
Published
2026-09-10T05:16Z
References (7)
https://github.com/DaveGamble/cJSON/ · [email protected]https://github.com/DaveGamble/cJSON/issues/1060 · [email protected]https://github.com/DaveGamble/cJSON/pull/1065 · [email protected]https://vuldb.com/cve/CVE-2026-87933 · [email protected]https://vuldb.com/submit/911136 · [email protected]https://vuldb.com/vuln/401815 · [email protected]https://vuldb.com/vuln/401815/cti · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 10 SEP 00:15Z
    DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
    cvelistv5