https://vulnerability.circl.lu/sightings/feed 2026-08-14T23:33:52.323870+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fac03697-3e00-4588-ada2-03edd3da71cd/export 2026-08-14T23:33:52.347271+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "fac03697-3e00-4588-ada2-03edd3da71cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51283", "type": "seen", "source": "https://gist.github.com/programmervuln/c1fea9d3513e8eedf6c3884dbaa9edc4", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51283\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51283\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON comparison value evaluation logic of the SQLite JSON1 extension. An attacker-supplied malformed oversized comparison operand payload processed by json_compare and JSON conditional evaluation functions triggers heap deallocation for a comparison value buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Absence of runtime bounds validation for attacker-controlled comparison string length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonCompareEval() function. Successful exploitation can lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON comparison string invokes the vulnerable jsonCompareEval() function defined in src/json.c.\nSource file src/json.c Line 3127 executes sqlite3_free(pCmpCtx->pValBuf); to release heap memory allocated for JSON comparison operand storage.\nThe pCmpCtx->pValBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized comparison value length values bypass all pre-write capacity boundary validation checks for the value buffer copy operation.\nSource file src/json.c Line 3174 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed value buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3210 performs direct memory structure lookup using the unmodified dangling pCmpCtx->pValBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON comparison and conditional filtering functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON comparison SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3127(memory free), Line 3210(dangling pointer access), Line 3174(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_compare('\"test\"', printf('%.*c',0x5600,'C'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==14027==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100000071a0 at pc 0x562554720811 bp 0x7fffcf5a7f50 sp 0x7fffcf5a7f40\nREAD of size 16 at 0x6100000071a0 thread T0\n #0 0x562554720810 in jsonCompareEval src/json.c:3210\n #1 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n #2 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\n #3 0x56255442b060 in sqlite3Step src/vdbeapi.c:530\n #4 0x56255442b7f0 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x56255433e930 in main shell.c:1339\n #6 0x7fc089c550ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x56255433a3e0 in _start (sqlite3:0x56255433a3e0)\n\nAddress 0x6100000071a0 is located 96 bytes inside of 22016-byte free block 0x610000007150-0x61000000c510\nFreed by thread T0 here:\n #0 0x7fc093474ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x562554720340 in jsonCompareEval src/json.c:3127\n #2 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n #3 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\n\nPreviously allocated by thread T0 here:\n #0 0x7fc093469ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x56255471fb20 in jsonCompareEval src/json.c:3070\n #2 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n\n==14027==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6100000071a0 at pc 0x562554720621 bp 0x7fffcf5a7f70 sp 0x7fffcf5a7f60\nWRITE of size 22016 at 0x6100000071a0 thread T0\n #0 0x562554720620 in jsonCompareEval src/json.c:3174\n #1 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n #2 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_compare with a second comparison operand constructed via printf('%.*c',0x5600,'C') to generate an attacker-controlled oversized comparison string for JSON value comparison parsing.\nSQLite forwards the untrusted comparison evaluation request to the jsonCompareEval() function within src/json.c, which initializes a comparison context and allocates the pCmpCtx->pValBuf heap buffer dedicated to storing parsed JSON comparison operand data.\nDuring intermediate comparison parsing cleanup logic at Line 3127, the value buffer is released via sqlite3_free(), while the pCmpCtx->pValBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized comparison operand payload into the buffer at Line 3174; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated value buffer heap region (CWE-787).\nProgram execution proceeds to Line 3210 and directly dereferences the stale dangling pCmpCtx->pValBuf pointer to read comparison operand metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON comparison evaluation execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-24\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3127: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pCmpCtx->pValBuf);\n\n// Line 3174: Unchecked out-of-bounds memory write utilizing attacker-controlled comparison value length\nmemcpy(pCmpCtx->pValBuf + valOffset, zValData, valDataLen);\n\n// Line 3210: Illegal dangling pointer dereference triggering Use After Free vulnerability\nvalType = pCmpCtx->pValBuf[valIdx].cmpValueType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51283\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3127\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3210\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3174\n\u3010Target Function Name\u3011: jsonCompareEval\n\u3010Exploit Trigger Payload\u3011: SELECT json_compare('\"test\"', printf('%.*c',0x5600,'C'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON comparison operand payload triggers early comparison value buffer free without pointer invalidation, unbounded value copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON comparison final evaluation\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-24\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:33:41.655676Z"} 2026-08-01T03:33:41.655676+00:00