cJSON CVE-2026-87933

Exploitation requires that the consuming application call cJSONUtils_MergePatch(target, patch) where the patch pointer is a node within target's own allocated tree - specifically, a subtree obtained via cJSON_GetObjectItem() or equivalent on the same target object, rather than an independently parsed or constructed JSON value. This aliasing pattern is uncommon in typical usage but can occur in applications that allow clients to specify which existing field to use as the patch. Applications that always construct patch objects independently from target objects are not vulnerable. Additionally, reliable code execution beyond DoS requires a favourable heap layout following the free, which is allocator- and platform-dependent and not guaranteed.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/PR:N/UI:N reflects a remotely triggerable flaw in an unauthenticated context, but the AC:L rating warrants scrutiny. The UAF fires only when the patch argument is a pointer into the target's own JSON tree - an application-level aliasing condition that many call sites will not produce naturally. In practice, exploitability depends heavily on how the consuming application wires the merge-patch API: if an attacker controls a JSON endpoint that applies a user-supplied patch to an object containing the user's own sub-fields, the condition can be engineered, but a typical server-side usage with independently constructed patch objects would not be vulnerable. A public PoC exists (E:P in the provided CVSS 4.0), which meaningfully raises urgency. No CISA KEV listing is present and no EPSS data was provided. The primary confirmed impact is heap-use-after-free leading to crash (DoS); memory disclosure or arbitrary code execution are theoretically possible depending on heap layout and allocator behaviour but are not confirmed by available data.

An attacker sends a crafted JSON payload to a REST API or embedded device endpoint that internally extracts a sub-field from the stored target document and passes it as the patch argument to cJSONUtils_MergePatch() - for example, an update handler that merges a user-nominated key from an existing record back onto the record itself. When cJSON_Delete(target) executes, the patch memory is freed mid-operation, and the subsequent cJSON_Duplicate() reads the freed heap region, causing a crash or potentially leaking heap metadata. A public PoC demonstrating this scenario with AddressSanitizer output is available at https://github.com/DaveGamble/cJSON/issues/1060.