CVE-2026-87933

Name	CVE-2026-87933
Description	A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1149958

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cjson (PTS)	bookworm, bookworm (security)	1.7.15-1+deb12u4	vulnerable
	trixie (security), trixie	1.7.18-3.1+deb13u1	vulnerable
	forky, sid	1.7.19-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cjson	source	(unstable)	(unfixed)			1149958

Notes

https://github.com/DaveGamble/cJSON/issues/1060
https://github.com/DaveGamble/cJSON/pull/1065
Fixed by: https://github.com/DaveGamble/cJSON/commit/6d9f2443ab071f86e5d9b43025a40929ec41c46c