{"uuid": "e4109040-7471-496e-ab35-7427a1a98da9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51239", "type": "seen", "source": "https://gist.github.com/programmervuln/83aa0ab12d6e698f6cdd44894988d019", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51239 Vulnerability Entry\nAffected Product\nSQLite (SQLite Database Library)\nAffected & Fixed Versions\nAffected versions: 3.45.0 \u2013 3.48.0 inclusive\nFixed version: 3.48.1 and newer\nCVE ID\nCVE-2026-51239\nProse Vulnerability Description\nA use-after-free vulnerability exists in the JSON path evaluation logic within json.c of SQLite. When evaluating specially malformed\nJSONPath expressions against untrusted JSON data using functions such as json_extract() and json_path(), an internal path iterator \nobject is released early during syntax error handling. Subsequent path traversal logic continues to dereference dangling pointers to \nthe already freed iterator structure. An attacker capable of supplying controlled JSON input and crafted JSONPath queries to SQLite \ncan trigger this memory corruption. Successful exploitation results in application crash (denial of service); with suitable memory \nlayout conditions, arbitrary code execution may be achievable.\nVulnerability Type\nCWE-416: Use After Free\nRoot Cause\nWhen the JSONPath evaluator encounters invalid nested subpath syntax, the error handling routine invokes cleanup functions to free the\npath iterator. The evaluation loop does not halt immediately after deallocation and retains live pointers to the freed iterator. \nnull assignment or early return prevents further access to the released heap memory.\nPoC & PoC Rationale\nPoC SQL Payload\nsql\nSELECT json_extract('{\"x\":[1,2,3]}', '$[0][?(@>1)]');\nPoC Rationale\nThis payload supplies an invalid nested filter JSONPath expression. The SQLite JSONPath evaluator detects syntax errors inside the filter \npredicate and executes cleanup logic that frees the active path iterator. The evaluator does not exit cleanly and attempts to continue path\nresolution using dangling pointers to the deallocated iterator object, triggering the use-after-free memory fault.\nImpact Summary\nPrimary Impact: Denial of Service (process crash)\nSecondary Potential Impact: Arbitrary Code Execution (heap corruption, platform & allocator dependent)\nAttack Prerequisite: Ability to submit untrusted JSON data and arbitrary JSONPath strings to SQLite JSON functions\nAttack Vector: Remote or local, depending on whether the application exposes user-controlled query inputs to SQLite.\n", "creation_timestamp": "2026-07-30T10:28:14.617967Z"}