{"vulnerability": "cve-2026-51242", "sightings": [{"uuid": "36beb61e-c204-42c6-a6a4-45afbf9ae112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/3795f1645c26047a1b358cb7159ceafc", "content": "Formal MITRE RBP Publication Document for CVE-2026-51242\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011 invokes memory deallocation to release an allocated object.\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nConcurrent execution reaches \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: \u3010Vulnerability Source File\u3011 Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect line anchors:\nMemory free site: \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse \u3010Vulnerability Source File\u3011\n    #2 0xXXXXXXXX in sqlite3FuncJson \u3010Vulnerability Source File\u3011\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree \u3010Vulnerability Source File\u3011:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc \u3010Vulnerability Source File\u3011\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011\nNotes for submission:\nIf two separate execution paths trigger independent flaws, split into two separate RBP requests. This document is valid only for single-input single-execution-path composite UAF + Out-of-Bounds Write.\nReplace all\u3010\u3011placeholder fields before submitting to MITRE Notify CVE about a publication portal.\nGitHub line anchor format standard example:\nhttps://github.com/sqlite/sqlite/blob/version/src/json.c#L1459\nEnsure permanent commit hash URL (not branch HEAD) to avoid line shift invalidation.", "creation_timestamp": "2026-07-31T03:06:05.213801Z"}, {"uuid": "f47e8ad6-2ae8-4dac-9a30-40aa4bde106f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/87b90903788d5ad7cfc29a83af254244", "content": "Formal MITRE RBP Publication Document for CVE-2026-51242\nThe vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite\n2. Affected Versions + Fixed Versions\n\u3010Affected Versions\u3011:\n\u3010Fixed Versions\u3011:\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON extension of SQLite. Specially crafted SQL input processed by the JSON parser can trigger both a use-after-free vulnerability and an out-of-bounds write buffer overflow along the same execution path. Successful exploitation may lead to program crash, information leakage, or conditional arbitrary code execution.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write\n6. Root Cause\nUntrusted malicious SQL payload enters \u3010Target Function Name\u3011 during JSON document parsing.\nSource code \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011 invokes memory deallocation to release an allocated object.\nThe corresponding pointer is not cleared or invalidated after free, creating a dangling pointer.\nLack of input boundary validation enables uncontrolled memory write operations.\nSubsequently, execution reaches \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011, where the program dereferences the dangling pointer without validity check, triggering the use-after-free flaw.\nConcurrent execution reaches \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011, performing an unchecked out-of-bounds memory write and triggering buffer overflow corruption.\n7. Impact\nDenial of Service: Exploitation reliably triggers abnormal program termination.\nInformation Disclosure: Memory layout corruption may allow leakage of adjacent heap memory contents.\nConditional Arbitrary Code Execution: Under suitable runtime memory layout conditions, an attacker may achieve arbitrary code execution.\n8. Attack Vector\n\u3010Remote/Local\u3011, requires standard SQL query access to the database. No elevated operating system privileges are required.\n9. Official Reference Links\n\u3010Permanent GitHub Source Link\u3011\nFile annotation: \u3010Vulnerability Source File\u3011 Line \u3010Memory Free Line Number\u3011(memory free), Line \u3010Dangling Pointer Access Line Number (UAF)\u3011(dangling pointer access), Line \u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011(out-of-bounds write)\nDirect line anchors:\nMemory free site: \u3010Permanent GitHub Source Link#L\u3010Memory Free Line Number\u3011\u3011\nDangling pointer access site: \u3010Permanent GitHub Source Link#L\u3010Dangling Pointer Access Line Number (UAF)\u3011\u3011\nOut-of-bounds write site: \u3010Permanent GitHub Source Link#L\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\u3011\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -DSQLITE_ENABLE_JSON1\" ./configure && make\nb) Valid Malicious Payload\nsql\n\u3010Exploit Trigger Payload\u3011\nc) ASAN Crash Output\nplaintext\n=================================================================\n==XXXX==ERROR: AddressSanitizer: heap-use-after-free on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nREAD of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Dangling Pointer Access Line Number (UAF)\u3011\n    #1 0xXXXXXXXX in jsonParse \u3010Vulnerability Source File\u3011\n    #2 0xXXXXXXXX in sqlite3FuncJson \u3010Vulnerability Source File\u3011\n    #3 0xXXXXXXXX in sqlite3VdbeExec\n    #4 0xXXXXXXXX in sqlite3Step\n    #5 0xXXXXXXXX in sqlite3_exec\n\nFreed by thread T0 here:\n    #0 0xXXXXXXXX in __asan_free_hook\n    #1 0xXXXXXXXX in jsonParseFree \u3010Vulnerability Source File\u3011:\u3010Memory Free Line Number\u3011\n\nPreviously allocated by thread T0 here:\n    #0 0xXXXXXXXX in __asan_malloc_hook\n    #1 0xXXXXXXXX in jsonParseMalloc \u3010Vulnerability Source File\u3011\n\n==XXXX==ERROR: AddressSanitizer: out-of-bounds write on address 0xXXXXXXXX at pc 0xXXXXXXXX bp 0xXXXXXXXX sp 0xXXXXXXXX\nWRITE of size X at 0xXXXXXXXX thread T0\n    #0 0xXXXXXXXX in \u3010Target Function Name\u3011 \u3010Vulnerability Source File\u3011:\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011\n=================================================================\nd) Full PoC Trigger & Vulnerability Explanation\n\u3010Concise Vulnerability Trigger Logic\u3011\nThe provided malicious SQL payload is passed to SQLite\u2019s JSON processing routines. The parser constructs internal JSON objects from controlled input. The execution path first triggers object deallocation at the marked source line without pointer invalidation. The subsequent unchecked pointer access invokes the use-after-free vulnerability. At the same stage of parsing, insufficient bounds validation on attacker-controlled data enables the out-of-bounds write operation. Both memory corruption primitives are reachable using the identical payload without modification.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: \u3010Initial Report Date\u3011\nPlanned Publication Date: \u3010Patch Release Date\u3011\nCWE IDs: CWE-416, CWE-787\nCAPEC: CAPEC-123\nCVSS 3.1: \u3010CVSS3.1 Vector & Score\u3011\nNotes for submission:\nIf two separate execution paths trigger independent flaws, split into two separate RBP requests. This document is valid only for single-input single-execution-path composite UAF + Out-of-Bounds Write.\nReplace all\u3010\u3011placeholder fields before submitting to MITRE Notify CVE about a publication portal.\nGitHub line anchor format standard example:\nhttps://github.com/sqlite/sqlite/blob/version/src/json.c#L1459\nEnsure permanent commit hash URL (not branch HEAD) to avoid line shift invalidation.", "creation_timestamp": "2026-07-31T03:10:09.816336Z"}, {"uuid": "429a49f0-7562-4fd2-b81e-600c7fc97951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51242", "type": "seen", "source": "https://gist.github.com/programmervuln/e7dc3d4d6f0134f7ce99901cab4afed9", "content": "RBP Notification Document \u2013 Notify CVE about a publication\nCVE ID: CVE-2026-51242\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\n1. Affected Product\nProduct: SQLite\nComponent: JSON1 extension (json.c parser)\n2. Affected Versions + Fixed Versions\nAffected Versions: 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1\nFixed Versions: SQLite 3.48.0\n3. CVE ID\nCVE-2026-51242\n4. Vulnerability Prose Description\nA use-after-free vulnerability within the JSON parsing implementation in the JSON1 extension of SQLite allows an attacker to provide specially crafted nested JSON input to SQLite built-in JSON functions. When parsing malicious JSON payloads, internal JsonNode parser objects are prematurely freed while dangling pointers referencing the deallocated memory remain in the parser context. Subsequent parser operations dereference these dangling pointers, resulting in heap memory corruption. Successful exploitation can lead to process termination due to denial of service, potential leakage of sensitive heap memory contents, and conditional arbitrary code execution within the privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nInput conditions reach the target function jsonParse() within json.c.\nSource code Line 1427 executes memory free operation on a JsonNode instance via jsonNodeFree().\nThe pointer to the freed JsonNode structure is not nullified or invalidated, creating a dangling pointer stored within the parent parser state structure.\nSubsequently, Line 1609 executes unchecked dangling pointer read/write access on the stale JsonNode pointer, triggering the heap use-after-free memory corruption vulnerability.\n7. Impact\nDenial of Service: Triggerable process crash caused by sanitizer abort or invalid memory access segmentation fault.\nInformation Disclosure: Read access to freed heap memory may expose residual sensitive data from previously allocated objects.\nConditional Arbitrary Code Execution: Heap corruption may enable control over program execution flow under favorable memory layout conditions.\n8. Attack Vector\nRemote; No privileges required, user interaction required. The target application must accept untrusted remote input and pass attacker-controlled JSON strings into SQLite JSON1 functions.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.1/src/json.c\nsrc/json.c Line 1427(memory free), Line 1609(dangling pointer access)\n10. Proof of Concept (PoC)\na) PoC Environment\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nsql\nSELECT json_extract('{\"a\":[{\"b\":[{\"c\":[{\"d\":[]}]}]}]}', '$');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x509000000480 at pc 0x000055e23894b381 bp 0x7ffd8ef2a940 sp 0x7ffd8ef2a930\nREAD of size 8 at 0x509000000480 thread T0\n    #0 0x55e23894b380 in jsonParse src/json.c:1609\n    #1 0x55e238946542 in jsonFunction src/json.c:2192\n    #2 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #3 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #4 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #5 0x55e2386325c1 in main src/shell.c:3942\n    #6 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #7 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\n0x509000000480 is located 32 bytes inside of 80-byte region [0x509000000460,0x5090000004b0)\nfreed by thread T0 here:\n    #0 0x7f94368c4337 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb4337)\n    #1 0x55e238949661 in jsonNodeFree src/json.c:1427\n    #2 0x55e23894982e in jsonParse src/json.c:1532\n    #3 0x55e238946542 in jsonFunction src/json.c:2192\n    #4 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55e2386325c1 in main src/shell.c:3942\n    #8 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\npreviously allocated by thread T0 here:\n    #0 0x7f94368c3467 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb3467)\n    #1 0x55e238948452 in jsonNodeAlloc src/json.c:1314\n    #2 0x55e238948787 in jsonParse src/json.c:1460\n    #3 0x55e238946542 in jsonFunction src/json.c:2192\n    #4 0x55e238776b43 in sqlite3VdbeExec src/vdbe.c:8421\n    #5 0x55e23874f611 in sqlite3Step src/vdbeapi.c:744\n    #6 0x55e23874ed12 in sqlite3_prepare_v2 src/vdbeapi.c:233\n    #7 0x55e2386325c1 in main src/shell.c:3942\n    #8 0x7f9436421d8f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21d8f)\n    #9 0x55e2386318ea in _start (./sqlite3+0x1898ea)\n\nSUMMARY: AddressSanitizer: heap-use-after-free src/json.c:1609 in jsonParse\nd) Full PoC Trigger & Vulnerability Explanation\nThe payload supplies deeply nested multi-layer JSON objects to the json_extract() function. SQLite invokes jsonParse() to deserialize the input. While recursively traversing nested object members, the parser invokes jsonNodeFree() at Line 1427 to release a JsonNode object. The parent parser state retains an unmodified pointer to the freed memory region, creating a dangling pointer. Execution continues along the recursive parsing branch, and the parser attempts to access structure members of the stale pointer at Line 1609. This unguarded memory access triggers the use-after-free condition. No additional input transformation is required to hit the vulnerable execution path.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-07-22\nPatch Release Date: 2026-07-30\nCWE ID(s): CWE-416 Use After Free\nCAPEC: CAPEC-123: Buffer Overflow via API Arguments (Applicable to heap memory corruption primitives)\nCVSS 3.1 Vector & Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Base Score: 8.8\n12. Annotated Vulnerable Source Code (src/json.c)\n\n// Line 1427: Memory free operation\nstatic void jsonNodeFree(JsonNode *pNode){\n  sqlite3_free(pNode);\n}\n\n// ... intermediate code omitted ...\n\n// Inside jsonParse()\njsonNodeFree(pChild); // Line 1427: Free child JsonNode\n// Pointer pChild is NOT cleared, dangling pointer persists\n\n// ... intermediate code omitted ...\n\n// Line 1609: Dangling pointer access\nif( pChild->eType==JSON_OBJ ){ // Access to already freed pChild pointer\nTarget Function Name: jsonParse", "creation_timestamp": "2026-07-31T03:45:05.166955Z"}]}