EUVD-2026-75225
GHSA-7jcg-95pj-h5fp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the UAF triggers only when patch is aliased as a subtree of target, a specific application-level condition absent from typical usage; C/I/A:L reflects UAF impact class without confirmed full code execution.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Heap use-after-free in DaveGamble cJSON's cJSONUtils_MergePatch function (cJSON_Utils.c) affects all versions through 1.7.19 when the patch argument is a subtree of the target object. The function deletes the target before duplicating the patch, freeing the patch memory and causing a subsequent read of freed heap - confirmed by an AddressSanitizer-triggering test case in upstream fix PR #1065. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the consuming application call cJSONUtils_MergePatch(target, patch) where the patch pointer is a node within target's own allocated tree - specifically, a subtree obtained via cJSON_GetObjectItem() or equivalent on the same target object, rather than an independently parsed or constructed JSON value. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 with AV:N/AC:L/PR:N/UI:N reflects a remotely triggerable flaw in an unauthenticated context, but the AC:L rating warrants scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A fix is available as GitHub PR #1065 (https://github.com/DaveGamble/cJSON/pull/1065) against the main branch, but it had not been merged into a tagged release at time of analysis - the description explicitly states the PR 'awaits acceptance', so a released patched version is not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. Rated critical severity (CVSS 9.8), this
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. Rated critical severity (CVSS 9.8)
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can r
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can resu
cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of func
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. Rated
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. Ra
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. Rated high severity (
Denial of service in cJSON (DaveGamble's C JSON parser) through version 1.7.19 lets a remote attacker crash any applicat
Denial of service in the cJSON C library (versions through 1.7.19) arises from exponential algorithmic complexity in the
Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today