# CVE-2026-87933: cJSON use-after-free in MergePatch

Source: https://junglewise.ai/threats/cve-2026-87933-cjson-use-after-free-in-mergepatch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87933 · Severity: high · CVSS 7.3 · Published 2026-09-10

cJSON is a lightweight JSON parsing library used in many C/C++ applications. A use-after-free vulnerability exists in the MergePatch function, which is used to merge JSON objects. An attacker who can control JSON input to an application using this library could cause a crash or potentially execute arbitrary code by triggering memory corruption.

Technologies: [DaveGamble cJSON](https://junglewise.ai/threats/technologies/cjson). Vendors: [DaveGamble](https://junglewise.ai/threats/vendors/davegamble).

## Quick answers

**Is CVE-2026-87933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87933 being exploited in the wild.

**How severe is CVE-2026-87933?** High severity, with a CVSS score of 7.3, published 10 September 2026.

**Which products and versions are affected?** DaveGamble cJSON up to 1.7.19.

**Is there a fix for CVE-2026-87933?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87933 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-87933?** Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap use-after-free (UAF) exists in cJSON's RFC 7386 MergePatch implementation within the merge_patch() function in cJSON_Utils.c. When cJSONUtils_MergePatch() is called with a non-object patch (e.g., an array or scalar), the function frees the target object at line 1328, then immediately calls cJSON_Duplicate(patch, 1). The cJSON_Duplicate_rec() function dereferences the freed memory when reading item->type from the already-freed object, causing a use-after-free condition. The vulnerability requires the attacker to supply malformed JSON input to an application that uses the MergePatch API. A fix is available via pull request: duplicate the patch before freeing the target, or null-check before freeing.

## Affected products

- DaveGamble cJSON up to 1.7.19

## Timeline

- 2026-09-10: disclosed
- other: Exploit made public; fix awaits pull request acceptance

## References

- [https://github.com/DaveGamble/cJSON/](https://github.com/DaveGamble/cJSON/)
- [https://github.com/DaveGamble/cJSON/issues/1060](https://github.com/DaveGamble/cJSON/issues/1060)

## Related threats

- [cJSON JSON Pointer escape sequence bypass in decode_pointer_inplace()](https://junglewise.ai/threats/cve-2026-29036-cjson-json-pointer-escape-sequence-bypass-in-decode-pointer)
- [DaveGamble cJSON non-atomic JSON Patch application in cJSON_Utils.c](https://junglewise.ai/threats/cve-2026-67217-davegamble-cjson-non-atomic-json-patch-application-in-cjson-utils)
- [DaveGamble cJSON denial of service in cJSON_Compare](https://junglewise.ai/threats/cve-2026-67216-davegamble-cjson-denial-of-service-in-cjson-compare)
- [DaveGamble cJSON uncontrolled recursion in cJSONUtils_ApplyPatches](https://junglewise.ai/threats/cve-2026-67215-davegamble-cjson-uncontrolled-recursion-in-cjsonutils)
- [DaveGamble cJSON integer overflow in print_string_ptr](https://junglewise.ai/threats/cve-2026-16554-davegamble-cjson-integer-overflow-in-print-string-ptr)