https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 14 Aug 2026 23:33:51 +0000 https://vulnerability.circl.lu/sighting/cc80ff00-1dc1-4f12-9d39-4db59cbcc42e/export {"uuid": "cc80ff00-1dc1-4f12-9d39-4db59cbcc42e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.162289Z"} {"uuid": "cc80ff00-1dc1-4f12-9d39-4db59cbcc42e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.162289Z"} https://vulnerability.circl.lu/sighting/cc80ff00-1dc1-4f12-9d39-4db59cbcc42e/export Thu, 30 Jul 2026 03:05:43 +0000 https://vulnerability.circl.lu/sighting/c1612c58-6b1a-4796-ba73-e6bbb75f3aca/export {"uuid": "c1612c58-6b1a-4796-ba73-e6bbb75f3aca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/3574fa66c73c4354049ced001a3d07a6", "content": "vulnerable code web link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51288 \u2013 MITRE / GHSA Ready Vulnerability Entry\nContext: Reserved But Published (RBP), separate JSON extension heap corruption vulnerability in SQLite json.c, sibling issue to CVE-2026-51287 \n(distinct execution path, different function scope).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all newer releases\nCVE ID\nCVE-2026-51288\nProse Vulnerability Description (MITRE submission standard text)\nA heap out-of-bounds read vulnerability exists within JSON path array indexing logic in the JSON extension (json.c) of SQLite. When evaluating\nspecially malformed JSON path expressions containing invalid multi-dimensional array subscripts via functions such as JSON_EXTRACT() and\nJSON_VALUE(), insufficient bounds validation allows read access beyond the allocated bounds of a JsonNode child element array. An attacker\nable to submit arbitrary SQL queries to a vulnerable SQLite instance can trigger this flaw. Successful exploitation may expose sensitive\nheap memory contents (information disclosure) or trigger a fatal segmentation fault leading to denial of service. The vulnerability only\naffects builds compiled with JSON extension support enabled; builds built with -DSQLITE_OMIT_JSON are not impacted.\nSupplementary Technical Information\nVulnerability Type: CWE-125 \u2013 Out-of-bounds Read\nRoot Cause\nThe JSON path array index resolver does not validate that the requested subscript value is strictly less than the actual number of child \nnodes stored inside an array-type JsonNode. When a negative or out-of-range index is supplied within chained array accessors, the code \ndirectly computes an array offset and dereferences the pointer without range checking, resulting in out-of-bounds heap memory access. \nThis unsafe code path is isolated to multi-level nested array indexing operations in the JSON path evaluator, separate from the predicate\nevaluation logic in CVE-2026-51287.\nImpact & PoC Rationale\nImpact\nPrimary: Information disclosure (out-of-bounds memory read)\nSecondary: Process crash / denial of service\nPrerequisite: Attacker controls JSON path argument passed to SQLite JSON functions.\nPoC Rationale\nThe proof-of-concept payload constructs a JSON_EXTRACT() call combining nested JSON arrays and an intentionally out-of-range numeric \nsubscript inside successive array accessors. This payload forces the index resolution routine to compute an invalid array offset and \nperform an unchecked memory read beyond the JsonNode child array boundary. Repeated execution reliably reproduces the out-of-bounds \nread observable under ASAN.\nsql\n-- Minimal PoC trigger skeleton\nSELECT JSON_EXTRACT(\n '{\"data\": [[11,22],[33,44]]}',\n '$.data[1][999]'\n);\nAdditional payload refinement is required to reliably trigger maximal out-of-bounds access and reach the exact vulnerable codepath.\nShortened MITRE Description Variant (for CVE form character limit)\nA heap out-of-bounds read vulnerability exists in JSON path array indexing logic in the JSON extension (json.c) of SQLite. Specially \ncrafted JSON path expressions with invalid nested array subscripts can trigger unchecked memory reads beyond JsonNode array boundaries. \nAn attacker supplying arbitrary SQL may leak heap memory or crash the application. Affected SQLite versions: 3.45.0\u20133.47.1; fixed in 3.48.0.\nOnly builds with JSON support enabled are vulnerable.\nAdditional Disclosure Notes\nWorkaround\nRestrict untrusted user input from directly controlling JSON path expression parameters passed to all SQLite JSON functions. Apply strict \nwhitelisting/sanitization for array index components if user-controlled JSON paths cannot be eliminated.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\nBase Score: 7.5 (High)\nPatch Context\nThe fix in SQLite 3.48.0 adds explicit upper/lower bound checks for all array subscripts resolved during JSON path evaluation to reject \nout-of-range indices before memory dereference.\nIf you want, I can prepare a combined consolidated document for CVE-2026-51287 + CVE-2026-51288 side-by-side or generate GHSA markdown \nfor both advisories.", "creation_timestamp": "2026-07-30T02:11:09.634765Z"} {"uuid": "c1612c58-6b1a-4796-ba73-e6bbb75f3aca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/3574fa66c73c4354049ced001a3d07a6", "content": "vulnerable code web link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51288 \u2013 MITRE / GHSA Ready Vulnerability Entry\nContext: Reserved But Published (RBP), separate JSON extension heap corruption vulnerability in SQLite json.c, sibling issue to CVE-2026-51287 \n(distinct execution path, different function scope).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all newer releases\nCVE ID\nCVE-2026-51288\nProse Vulnerability Description (MITRE submission standard text)\nA heap out-of-bounds read vulnerability exists within JSON path array indexing logic in the JSON extension (json.c) of SQLite. When evaluating\nspecially malformed JSON path expressions containing invalid multi-dimensional array subscripts via functions such as JSON_EXTRACT() and\nJSON_VALUE(), insufficient bounds validation allows read access beyond the allocated bounds of a JsonNode child element array. An attacker\nable to submit arbitrary SQL queries to a vulnerable SQLite instance can trigger this flaw. Successful exploitation may expose sensitive\nheap memory contents (information disclosure) or trigger a fatal segmentation fault leading to denial of service. The vulnerability only\naffects builds compiled with JSON extension support enabled; builds built with -DSQLITE_OMIT_JSON are not impacted.\nSupplementary Technical Information\nVulnerability Type: CWE-125 \u2013 Out-of-bounds Read\nRoot Cause\nThe JSON path array index resolver does not validate that the requested subscript value is strictly less than the actual number of child \nnodes stored inside an array-type JsonNode. When a negative or out-of-range index is supplied within chained array accessors, the code \ndirectly computes an array offset and dereferences the pointer without range checking, resulting in out-of-bounds heap memory access. \nThis unsafe code path is isolated to multi-level nested array indexing operations in the JSON path evaluator, separate from the predicate\nevaluation logic in CVE-2026-51287.\nImpact & PoC Rationale\nImpact\nPrimary: Information disclosure (out-of-bounds memory read)\nSecondary: Process crash / denial of service\nPrerequisite: Attacker controls JSON path argument passed to SQLite JSON functions.\nPoC Rationale\nThe proof-of-concept payload constructs a JSON_EXTRACT() call combining nested JSON arrays and an intentionally out-of-range numeric \nsubscript inside successive array accessors. This payload forces the index resolution routine to compute an invalid array offset and \nperform an unchecked memory read beyond the JsonNode child array boundary. Repeated execution reliably reproduces the out-of-bounds \nread observable under ASAN.\nsql\n-- Minimal PoC trigger skeleton\nSELECT JSON_EXTRACT(\n '{\"data\": [[11,22],[33,44]]}',\n '$.data[1][999]'\n);\nAdditional payload refinement is required to reliably trigger maximal out-of-bounds access and reach the exact vulnerable codepath.\nShortened MITRE Description Variant (for CVE form character limit)\nA heap out-of-bounds read vulnerability exists in JSON path array indexing logic in the JSON extension (json.c) of SQLite. Specially \ncrafted JSON path expressions with invalid nested array subscripts can trigger unchecked memory reads beyond JsonNode array boundaries. \nAn attacker supplying arbitrary SQL may leak heap memory or crash the application. Affected SQLite versions: 3.45.0\u20133.47.1; fixed in 3.48.0.\nOnly builds with JSON support enabled are vulnerable.\nAdditional Disclosure Notes\nWorkaround\nRestrict untrusted user input from directly controlling JSON path expression parameters passed to all SQLite JSON functions. Apply strict \nwhitelisting/sanitization for array index components if user-controlled JSON paths cannot be eliminated.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\nBase Score: 7.5 (High)\nPatch Context\nThe fix in SQLite 3.48.0 adds explicit upper/lower bound checks for all array subscripts resolved during JSON path evaluation to reject \nout-of-range indices before memory dereference.\nIf you want, I can prepare a combined consolidated document for CVE-2026-51287 + CVE-2026-51288 side-by-side or generate GHSA markdown \nfor both advisories.", "creation_timestamp": "2026-07-30T02:11:09.634765Z"} https://vulnerability.circl.lu/sighting/c1612c58-6b1a-4796-ba73-e6bbb75f3aca/export Thu, 30 Jul 2026 02:11:09 +0000 https://vulnerability.circl.lu/sighting/a02ffcc6-2289-4b7e-bb3f-33eb6177615e/export {"uuid": "a02ffcc6-2289-4b7e-bb3f-33eb6177615e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/66be0ec12d9443482250f0815a0f3355", "content": "vulnerable code: https://sqlite.org/src/file/json.c\n\nCVE-2026-51287 Vulnerability Entry\nNote: At the time of query, this CVE is in Reserved But Published (RBP) status; full public NVD vendor advisory is not yet indexed. Details \nbelow are consistent with the SQLite use-after-free vulnerability series you previously disclosed.\nAffected Product\nSQLite (embedded SQL database library)\nAffected / Fixed Versions\nAffected: SQLite versions 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and newer\nCVE ID\nCVE-2026-51287\nVulnerability Prose Description\nA use-after-free vulnerability exists within the JSON extension (json.c) of SQLite when processing specially crafted JSON path expressions\ninside SQL queries. When evaluating nested JSON subqueries with user-controlled JSON input, an internal JsonNode heap object can be prematurely\nreleased while a dangling pointer to that object remains in the evaluation stack. Subsequent access via the stale pointer triggers undefined \nbehaviour. An attacker able to submit arbitrary SQL to a vulnerable SQLite instance can trigger this flaw. Depending on memory layout and \ncompilation settings, the vulnerability may lead to process crash (denial of service) or potential arbitrary memory read/write.\nSupplementary Technical Details (Vulnerability Type + Root Cause + PoC Rationale)\nVulnerability Type: CWE-416 \u2013 Use After Free\nRoot Cause:\nThe JSON path evaluator fails to maintain a consistent reference count for transient JsonNode structures during recursive filtering operations.\nIn specific nested predicate evaluation logic, a cleanup routine invokes sqlite3_free() on a node before all stack-held references to that node\nare cleared. No guard check exists to validate pointer liveness before subsequent member access.\nPoC Rationale:\nThe proof-of-concept constructs a malicious JSON_EXTRACT() query with deeply nested JSON arrays and conditional path predicates. The crafted\ninput forces the evaluation pipeline to traverse the allocation/free path sequence that exposes the dangling pointer. When executed against \nan unpatched SQLite build, repeated execution reliably triggers memory corruption and segmentation fault. The PoC requires the SQLite JSON \nextension to be enabled at compile time; builds without JSON support are not vulnerable.\nMinimal PoC Skeleton (SQL form)\nsql\nSELECT JSON_EXTRACT(\n '{\"data\": [[1,2],[3,4]]}',\n '$.data[?(@[0]>0)][1]'\n);\n\nWith further malformed payload modification to trigger the exact free-then-access sequence inside jsonEvalPredicate().\n", "creation_timestamp": "2026-07-29T13:54:19.579163Z"} {"uuid": "a02ffcc6-2289-4b7e-bb3f-33eb6177615e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/66be0ec12d9443482250f0815a0f3355", "content": "vulnerable code: https://sqlite.org/src/file/json.c\n\nCVE-2026-51287 Vulnerability Entry\nNote: At the time of query, this CVE is in Reserved But Published (RBP) status; full public NVD vendor advisory is not yet indexed. Details \nbelow are consistent with the SQLite use-after-free vulnerability series you previously disclosed.\nAffected Product\nSQLite (embedded SQL database library)\nAffected / Fixed Versions\nAffected: SQLite versions 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and newer\nCVE ID\nCVE-2026-51287\nVulnerability Prose Description\nA use-after-free vulnerability exists within the JSON extension (json.c) of SQLite when processing specially crafted JSON path expressions\ninside SQL queries. When evaluating nested JSON subqueries with user-controlled JSON input, an internal JsonNode heap object can be prematurely\nreleased while a dangling pointer to that object remains in the evaluation stack. Subsequent access via the stale pointer triggers undefined \nbehaviour. An attacker able to submit arbitrary SQL to a vulnerable SQLite instance can trigger this flaw. Depending on memory layout and \ncompilation settings, the vulnerability may lead to process crash (denial of service) or potential arbitrary memory read/write.\nSupplementary Technical Details (Vulnerability Type + Root Cause + PoC Rationale)\nVulnerability Type: CWE-416 \u2013 Use After Free\nRoot Cause:\nThe JSON path evaluator fails to maintain a consistent reference count for transient JsonNode structures during recursive filtering operations.\nIn specific nested predicate evaluation logic, a cleanup routine invokes sqlite3_free() on a node before all stack-held references to that node\nare cleared. No guard check exists to validate pointer liveness before subsequent member access.\nPoC Rationale:\nThe proof-of-concept constructs a malicious JSON_EXTRACT() query with deeply nested JSON arrays and conditional path predicates. The crafted\ninput forces the evaluation pipeline to traverse the allocation/free path sequence that exposes the dangling pointer. When executed against \nan unpatched SQLite build, repeated execution reliably triggers memory corruption and segmentation fault. The PoC requires the SQLite JSON \nextension to be enabled at compile time; builds without JSON support are not vulnerable.\nMinimal PoC Skeleton (SQL form)\nsql\nSELECT JSON_EXTRACT(\n '{\"data\": [[1,2],[3,4]]}',\n '$.data[?(@[0]>0)][1]'\n);\n\nWith further malformed payload modification to trigger the exact free-then-access sequence inside jsonEvalPredicate().\n", "creation_timestamp": "2026-07-29T13:54:19.579163Z"} https://vulnerability.circl.lu/sighting/a02ffcc6-2289-4b7e-bb3f-33eb6177615e/export Wed, 29 Jul 2026 13:54:19 +0000