{"uuid": "f47e8ad6-2ae8-4dac-9a30-40aa4bde106f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/87b90903788d5ad7cfc29a83af254244", "content": "Formal MITRE RBP Publication Document for CVE-2026-51242\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011 invokes memory deallocation to release an allocated object.\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nConcurrent execution reaches \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: \u3010Vulnerability Source File\u3011 Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect line anchors:\nMemory free site: \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse \u3010Vulnerability Source File\u3011\n    #2 0xXXXXXXXX in sqlite3FuncJson \u3010Vulnerability Source File\u3011\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree \u3010Vulnerability Source File\u3011:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc \u3010Vulnerability Source File\u3011\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011\nNotes for submission:\nIf two separate execution paths trigger independent flaws, split into two separate RBP requests. This document is valid only for single-input single-execution-path composite UAF + Out-of-Bounds Write.\nReplace all\u3010\u3011placeholder fields before submitting to MITRE Notify CVE about a publication portal.\nGitHub line anchor format standard example:\nhttps://github.com/sqlite/sqlite/blob/version/src/json.c#L1459\nEnsure permanent commit hash URL (not branch HEAD) to avoid line shift invalidation.", "creation_timestamp": "2026-07-31T03:10:09.816336Z"}