Description

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-10T01:16:35.650Z",
  "pubdate": "2026-09-10T01:16:35.650Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified in the cJSONUtils_MergePatch function within DaveGamble cJSON versions up to 1.7.19. This vulnerability resides in the cJSON_Utils.c file and allows for remote exploitation by an unauthenticated attacker. The flaw arises from improper memory management during the JSON merge patch operation, where memory is referenced after it has been deallocated. Successful exploitation can lead to arbitrary code execution, denial of service through application crashes, or information disclosure, depending on the heap layout and attacker control over memory. Because a public exploit exists, the risk profile is significantly elevated. Systems utilizing cJSON for processing untrusted JSON inputs are at high risk, as the attack does not require prior authentication and can be triggered remotely. Given that a patch via pull request is currently pending acceptance, users are advised to monitor the upstream repository and prepare for immediate implementation of the forthcoming security update.",
  "technicalDetails": "The vulnerability is located in the cJSONUtils_MergePatch function within the cJSON_Utils.c file, a component of the DaveGamble cJSON library. The root cause of this Use-After-Free (UAF) condition is the mishandling of internal pointers during the application of JSON merge patches. When processing specifically crafted JSON patch objects, the logic fails to appropriately synchronize the lifecycle of object references or properly NULL-ify pointers after the underlying memory has been freed.\nThe attack flow commences when an attacker submits a malicious JSON payload to an application utilizing the affected cJSON library. The cJSONUtils_MergePatch function is invoked to process the input. During the execution path, the library may perform iterative operations on JSON structures where a nested object or property is deallocated to facilitate a merge or update action. Due to a logical error, a dangling pointer persists, which the function subsequently accesses or attempts to free again. This operation on freed memory corrupts the heap metadata or permits the attacker to influence control flow by manipulating the contents of the reallocated memory block.\nExploitation is feasible remotely without authentication. An attacker can craft a payload containing specific sequences of JSON merge operations that trigger the premature deallocation of a structure still in use by the merge logic. By filling the freed memory hole with attacker-controlled data via heap spraying techniques, the attacker can hijack the execution context when the library later attempts to dereference the dangling pointer. This can result in arbitrary instruction execution if the dangling pointer is used as a function pointer or a control flow target, or it can cause a segmentation fault leading to an immediate denial of service (DoS).\nAffected versions include all releases of cJSON up to and including 1.7.19. The vulnerability is fundamentally a memory safety issue resulting from complex pointer arithmetic and object lifecycle management during tree traversal and patching. Since the memory management logic in cJSON_Utils.c is responsible for both the parsing and the subsequent modification of JSON trees, any failure to maintain rigorous pointer integrity across these operations introduces significant memory safety risks. Post-exploitation, an attacker may achieve system-level compromise or bypass security constraints depending on the privileges of the process hosting the library."
}