{"uuid": "38fc4e13-4641-47e0-923e-58dd8c104b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51243", "type": "seen", "source": "https://gist.github.com/programmervuln/93176789b1e5b46d8aba1038a7d797d9", "content": "Formal MITRE RBP Publication Document for CVE-2026-51243\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51243\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code src/json.c Line \u3010Memory Free Line Number\u3011 invokes memory deallocation to release an allocated object.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Memory Free Line Number\u3011\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches src/json.c Line \u3010Dangling Pointer Access Line Number (UAF)\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\nConcurrent execution reaches src/json.c Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: src/json.c Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect permanent line anchors:\nMemory free site: \u3010Permanent GitHub Source Link\u3011#L\u3010Memory Free Line Number\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link\u3011#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link\u3011#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 src/json.c:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse src/json.c\n    #2 0xXXXXXXXX in sqlite3FuncJson src/json.c\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree src/json.c:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc src/json.c\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 src/json.c:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n    https://github.com/sqlite/sqlite/blob/COMMIT_SHA/src/json.c\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011", "creation_timestamp": "2026-07-31T03:26:49.169169Z"}