CVE-2026-87933

What it actually does

cJSON through 1.7.19 contains a use-after-free in cJSONUtils_MergePatch (cJSON_Utils.c). While applying a JSON Merge Patch, the function can free a heap-allocated JSON object and later dereference it. That memory-safety failure corrupts process heap state and can crash the hosting process, leak leftover heap contents, or yield limited integrity impact on the resulting JSON. CVSS reflects network reachability with no privileges or user interaction, but only low confidentiality, integrity, and availability impact on the vulnerable component—not inherent full remote code execution.

Why it matters to the business

Applications and firmware that apply JSON Merge Patch to untrusted input with this library can become unstable or crash, disrupting APIs, embedded devices, and C/C++ backends. Data derived from the merged document may be corrupted, with limited information exposure. The issue is not in CISA KEV, is not associated with ransomware, and has a low, flat EPSS (~0.53% over 30 days). Residual risk remains because a public exploit is described, no official fixed release is listed, and the upstream pull request is still awaiting acceptance—so statically linked and IoT/embedded copies may stay exposed.

How an attack unfolds

An unauthenticated remote attacker finds a service that feeds attacker-controlled JSON Merge Patch input into cJSONUtils_MergePatch (for example an HTTP API). They submit a malicious patch document that causes the library to free an internal object and then continue using it. The public exploit can be used to crash the process for denial of service or, under favorable heap conditions, to influence later memory use for limited disclosure or corruption. No privileges or user interaction are required. No named APT groups or ransomware campaigns are reported for this CVE.

How to fix it

No official fixed version is published; the upstream pull request is still awaiting acceptance. Until a patched cJSON release exists, do not pass untrusted or network-sourced input to cJSONUtils_MergePatch: disable merge-patch endpoints, reject unexpected patch documents, or switch merge-patch handling to a different, maintained JSON implementation. Inventory source, packages, containers, and statically linked binaries that bundle cJSON 1.7.19 or earlier. When an accepted fix ships, upgrade cJSON to that release or later, rebuild dependents, and apply vendor firmware updates. Do not rely on a version bump that does not include the pending cJSON_Utils.c change.

How to confirm the fix worked

Enumerate compiled binaries, SBOMs, and package manifests for cJSON <= 1.7.19 and for linkage of cJSON_Utils / cJSONUtils_MergePatch. Review call sites to confirm whether merge-patch handling accepts external input. After a workaround or future patch, retest legitimate RFC 7396 merge-patch operations and confirm previously crashing malformed inputs no longer abort the process (including under ASan/Valgrind in non-production builds). Verify the patched library is the one actually loaded or statically linked in the shipped artifact.

Typical attack path

1. Identify a network-reachable application or firmware image linked with cJSON 1.7.19 or earlier that applies JSON Merge Patch to external input.
2. Confirm that untrusted bodies reach cJSONUtils_MergePatch (or equivalent merge-patch handling) rather than a different JSON stack.
3. Submit a malicious merge-patch document that triggers free-then-reuse of an internal cJSON object.
4. Observe process crash, allocator abort, error responses, or anomalous merged output indicating heap corruption.
5. Repeat or vary requests to sustain denial of service or attempt limited memory disclosure or data corruption. No follow-on implant unique to this CVE is documented.

How to detect it

This is a library memory-safety flaw, not a distinct malware family, so hunt for crash and heap-fault artifacts rather than a unique implant. Review application, container, and systemd/journal logs for unexpected process exits, abort(), or allocator diagnostics in services known to use cJSON. Inspect core dumps and stack traces for frames in cJSONUtils_MergePatch or cJSON_Utils.c. On HTTP/API front ends, correlate crash timestamps with requests using Content-Type application/merge-patch+json or paths that perform JSON merge/patch, especially from unusual sources. No APT or ransomware campaign is reported and the CVE is not in KEV, so mass exploitation is not confirmed; still review crash storms after the public-exploit disclosure window (published about 30 days ago).

• cJSONUtils_MergePatch
• cJSON_Utils.c
• Content-Type: application/merge-patch+json
• AddressSanitizer: heap-use-after-free

What your security team should do

• Inventory applications, containers, firmware, and statically linked C/C++ binaries that include cJSON 1.7.19 or earlier.
• Disable or tightly constrain internet-facing JSON Merge Patch endpoints until an official patched release is available.
• Watch DaveGamble/cJSON for acceptance of the pending fix and schedule rebuilds and firmware updates immediately after it lands.
• Enforce API gateway or WAF policy that limits or blocks untrusted application/merge-patch+json traffic where merge-patch is not a required business function.
• Prioritize long-lived embedded/IoT and statically linked products that cannot be hot-patched.
• Treat this as patch-pending rather than KEV-urgent: low EPSS and no named campaigns, but a described public exploit and no listed fixed version.