CVE-2026-87933

HighCVSS 7.3/10Last modified Sep 10, 2026

Description

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-119CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2026
Last modified
Sep 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-879358.1The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_requCVE-2026-879366.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider aCVE-2026-879376.5URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the SourcCVE-2026-87938Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. TCVE-2026-879394.2Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. TCVE-2026-87946.9PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit thiCVE-2026-879405.4Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access CCVE-2026-87941Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.CVE-2026-879424.6Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. TCVE-2026-879436.5Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service PCVE-2026-879444.8Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affecCVE-2026-879455.4URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. Thi