CVE-2026-87933 Overview
CVE-2026-87933 is a use-after-free vulnerability in DaveGamble's cJSON library through version 1.7.19. The flaw resides in the cJSONUtils_MergePatch function within cJSON_Utils.c. An attacker can trigger the condition remotely by supplying crafted JSON merge patch input to an application that consumes it. The library is widely embedded in C and C++ applications, IoT firmware, and network services, expanding the potential exposure. A public exploit has been disclosed, and the upstream pull request that corrects the issue is still awaiting acceptance.
Critical Impact
Remote attackers can cause memory corruption in applications embedding cJSON, potentially leading to denial of service or exploitation of freed memory during JSON merge patch operations.
Affected Products
- DaveGamble cJSON versions up to and including 1.7.19
- Applications and firmware that statically or dynamically link the cJSON_Utils component
- Downstream software that calls cJSONUtils_MergePatch on untrusted JSON input
Discovery Timeline
- 2026-09-10 - CVE-2026-87933 published to the National Vulnerability Database
- 2026-09-10 - Record last modified in NVD
Technical Details for CVE-2026-87933
Vulnerability Analysis
The defect is a use-after-free condition [CWE-119] in the cJSONUtils_MergePatch routine defined in cJSON_Utils.c. JSON merge patch, defined by RFC 7396, recursively applies a patch document to a target document, replacing or removing keys based on the patch structure. During this traversal, the affected implementation frees a cJSON object node while a reference to that node remains reachable through the parent object's linked-list pointers. Subsequent operations dereference the stale pointer, producing undefined behavior.
Because the merge patch function operates on user-supplied JSON, any process that accepts external JSON and applies a client-controlled patch can reach the vulnerable code path. Consequences range from process crash and denial of service to more advanced exploitation when the freed allocation is reclaimed with attacker-controlled data.
Root Cause
The root cause is incorrect object lifetime management inside the recursive merge logic. A child node is released back to the heap without unlinking or updating the parent structure that still references it. Later iterations continue to walk the object graph, reading or writing memory that has been freed.
Attack Vector
The attack vector is network-accessible with no authentication and no user interaction required. An attacker sends a crafted JSON merge patch to any endpoint that invokes cJSONUtils_MergePatch on untrusted input. Embedded devices, REST APIs, message brokers, and configuration services that expose JSON patch semantics are common targets.
See the upstream discussion in GitHub Issue #1060 and the proposed fix in GitHub Pull Request #1065 for the vulnerable code path and remediation approach.
Detection Methods for CVE-2026-87933
Indicators of Compromise
- Unexpected process crashes or segmentation faults in services that parse JSON merge patches shortly after receiving external input.
- AddressSanitizer or Valgrind reports flagging heap-use-after-free inside cJSONUtils_MergePatch call stacks.
- Anomalous inbound JSON payloads containing deeply nested or repeatedly overlapping keys targeting patch endpoints.
Detection Strategies
- Perform software composition analysis on binaries and containers to identify statically linked cJSON versions at or below 1.7.19.
- Instrument non-production builds with AddressSanitizer to surface use-after-free triggers during fuzzing of JSON patch inputs.
- Deploy application-layer inspection on APIs that accept application/merge-patch+json and alert on malformed or oversized documents.
Monitoring Recommendations
- Monitor service telemetry for repeated crashes, restart loops, and abnormal exit codes correlated with inbound JSON traffic.
- Log request bodies and source addresses for endpoints that invoke merge patch operations to support post-incident analysis.
- Track third-party dependency manifests to detect reintroduction of vulnerable cJSON versions in future builds.
How to Mitigate CVE-2026-87933
Immediate Actions Required
- Inventory all applications, containers, and firmware images that bundle cJSON and identify uses of cJSONUtils_MergePatch.
- Restrict network exposure of endpoints that consume JSON merge patch payloads from untrusted clients until a patched build is deployed.
- Rebuild affected services against a patched cJSON source tree once the upstream fix is merged.
Patch Information
A fix is proposed upstream in GitHub Pull Request #1065 but had not been merged at the time of CVE publication. Track the cJSON repository for a tagged release containing the fix, and consult the VulDB entry for CVE-2026-87933 for updates.
Workarounds
- Disable or gate application features that call cJSONUtils_MergePatch on client-supplied input until an upstream release is available.
- Enforce strict input validation, including maximum depth and size limits, on JSON documents before invoking merge patch routines.
- Apply the patch from pull request #1065 locally to vendored copies of cJSON if a downstream release cannot wait for the upstream merge.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
