CVE-2026-87933: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-87933 is a heap use-after-free (UAF) vulnerability in DaveGamble cJSON affecting all versions up to and including 1.7.19. The flaw resides in the cJSONUtils_MergePatch() function within cJSON_Utils.c, where improper memory management during RFC 7386 MergePatch operations leads to reading freed heap memory. It was reported on July 30, 2026 (GitHub issue #1060) and published to the NVD on September 10, 2026. The vulnerability carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, cJSON Issue).

The root cause is a use-after-free (CWE-416) combined with improper memory buffer handling (CWE-119) in the static merge_patch() function in cJSON_Utils.c. When cJSONUtils_MergePatch() is called with a non-object patch (e.g., an array or scalar), the function calls cJSON_Delete(target) at line 1328 to free the target object, then immediately calls cJSON_Duplicate(patch, 1) at line 1329. If patch is a subtree of target, the freed memory may be reallocated by cJSON_New_Item() inside cJSON_Duplicate_rec(), and the dangling pointer is then dereferenced at cJSON.c:2808 (newitem->type = item->type), triggering a UAF read. A minimal reproducer input is the JSON number 1 followed by a newline ("1\n"), which libFuzzer discovered within 10 seconds. A public PoC and full ASAN crash output are available in the GitHub issue (cJSON Issue, cJSON PR).

Successful exploitation by an unauthenticated remote attacker can result in limited confidentiality loss (reading freed heap memory contents), limited integrity impact (potential data corruption via heap reuse), and availability impact (application crash/denial of service). Because cJSON is a widely embedded C library used in IoT devices, embedded systems, and networked applications, the blast radius depends heavily on the integrating application's exposure and privilege level. In the worst case, heap memory disclosure could leak sensitive in-memory data, and heap corruption could be leveraged for further exploitation in memory-unsafe contexts (Github Advisory, cJSON Issue).

A public proof-of-concept (PoC) in the form of minimal C code and a libFuzzer corpus entry has been disclosed in the GitHub issue, and the CVSS v4.0 exploit maturity is rated "Proof of Concept." No evidence of in-the-wild exploitation or threat actor attribution has been observed as of the publication date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No authentication or user interaction is required to trigger the vulnerability over the network (cJSON Issue, Github Advisory).

1. Identify target: Locate a networked application or service that uses cJSON versions 1.7.0–1.7.19 and exposes an endpoint that accepts user-controlled JSON input processed via cJSONUtils_MergePatch().
2. Craft malicious input: Prepare a JSON payload where the patch argument is a non-object type (e.g., an array or scalar) that is also a subtree of the target object. A minimal example is the JSON value 1 (a number), which triggers the UAF path.
3. Submit payload: Send the crafted JSON to the target endpoint. For example, using the direct API path: create a target object {"a": [1,2,3]}, then call cJSONUtils_MergePatch(target, cJSON_GetObjectItem(target, "a")) where the patch is a child of target.
4. Trigger UAF: The merge_patch() function calls cJSON_Delete(target) (freeing the memory), then cJSON_Duplicate(patch, 1) reads the already-freed memory at cJSON_Duplicate_rec line 2808, triggering the heap-use-after-free.
5. Achieve objective: Depending on heap layout and allocator behavior, the attacker may cause an application crash (DoS), read sensitive heap contents (information disclosure), or potentially achieve further memory corruption for code execution in vulnerable contexts (cJSON Issue, cJSON PR).

• Logs: Application crash logs or core dumps referencing cJSON_Duplicate_rec (cJSON.c:2808) or cJSON_Delete (cJSON.c:273/258) in stack traces; AddressSanitizer output reporting heap-use-after-free in merge_patch (cJSON_Utils.c:1328).
• Process: Unexpected process crashes or restarts in services that parse JSON using cJSON; abnormal memory usage patterns or segmentation faults in cJSON-linked binaries.
• Network: Repeated or anomalous JSON submissions to endpoints that invoke cJSONUtils_MergePatch(), particularly payloads containing non-object top-level values (arrays, numbers, strings) where an object is expected as a patch.

The fix is to reorder operations in merge_patch(): duplicate the patch into a local variable first, then delete the target, then return the duplicate ("Option B" from the issue). A pull request implementing this fix (PR #1065) has been submitted but was awaiting maintainer acceptance as of the publication date. Until an official patched release is available, organizations should: (1) monitor the cJSON repository for a release newer than 1.7.19 that incorporates the fix; (2) apply the patch from PR #1065 manually if building from source; and (3) restrict network access to systems using vulnerable cJSON versions where feasible (cJSON PR, Github Advisory).

The vulnerability was independently discovered and reported via fuzzing by GitHub user @1820893135-pixel (issue #1060, July 30, 2026), with a separate contributor (lilu5458) submitting a fix via PR #1065 on August 20, 2026. The GitHub Advisory Database classified it as "Moderate" severity and noted it as unreviewed. No significant broader media coverage or notable researcher commentary beyond the GitHub thread has been observed (cJSON Issue, cJSON PR).