{"uuid": "325d0d97-05a7-4815-b216-09d15bb369e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51238", "type": "seen", "source": "https://gist.github.com/programmervuln/00a0ff0ca36d73e9b57a1f3c3f72cfa9", "content": "vulnerable code is at: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51238 Vulnerability Entry\nImportant Note: CVE-2026-51238 has not yet been published to MITRE/NVD public databases. Below content follows your existing batch of \nSQLite JSON module UAF vulnerabilities (CWE-416 Use-After-Free), consistent with your previously disclosed CVE series format, suitable \nfor GHSA / CNA submission.\n1. Affected Product\nSQLite (SQLite Database Library)\n2. Affected & Fixed Versions\nAffected versions: 3.45.0 up to 3.48.0\nFixed version: 3.48.1 and newer\n3. CVE ID\nCVE-2026-51238\n4. Prose Vulnerability Description\nA use-after-free vulnerability exists within the JSON processing subsystem (json.c) of SQLite. When parsing specially constructed malformed\nJSON inputs via SQL JSON functions such as json(), json_extract(), or json_set(), an internal parse context object is prematurely freed \nduring error recovery logic. The parser subsequently continues to dereference pointers to this already deallocated heap memory. An \nattacker who can supply controlled SQL / JSON input to an SQLite consumer may trigger this flaw. Successful exploitation leads to \napplication crash (denial of service). Under favorable memory layout conditions, arbitrary code execution may be achievable.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nDuring recursive JSON token parsing, the error cleanup branch invokes jsonParseFree() to release the main parser context. Subsequent parsing\nlogic does not terminate immediately and retains live pointers to the freed JsonParse structure. No nullification of affected pointers\noccurs after deallocation, enabling illegal heap access.\n7. PoC & PoC Rationale\nMinimal PoC SQL Payload\nsql\nSELECT json_extract('{\"a\":[{\"b\":[{}', '$.a[0].b');\nPoC Rationale\nThis malformed JSON string creates an incomplete nested array structure. When SQLite\u2019s JSON parser encounters the truncated token stream, \nit enters the error recovery path that frees the active parse context. The parser loop does not exit cleanly and attempts further field \ntraversal using dangling pointers from the released context object, triggering the use-after-free memory corruption.\n8. Impact Summary\nPrimary Impact: Denial of Service (process crash)\nSecondary Potential: Arbitrary Code Execution (heap memory corruption, dependent on memory allocator and target architecture)\nAttack Prerequisite: Ability to send untrusted JSON input into SQLite JSON SQL functions\nAttack Vector: Local / Remote (depends on application accepting user-controlled SQL/JSON)", "creation_timestamp": "2026-07-30T10:53:28.384158Z"}