CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-87933

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Score
6.9 medium
Published
2026-09-10
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
devel/libcjsonlibcjson1.7.19_1unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>libcjson</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A vulnerability was found in DaveGamble cJSON up to 1.7.19. The
	affected element is the function cJSONUtils_MergePatch of the file
	cJSON_Utils.c. The manipulation results in use after free. The attack
	may be launched remotely. The exploit has been made public and could
	be used. The pull request to fix this issue awaits acceptance.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-87933</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-87933</url>
    </references>
    <dates>
      <discovery>2026-09-10</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>