{"uuid": "4f187228-befe-461a-8859-a52758e3bdfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/8306193823c86e7ccb208f92d45c9f70", "content": "vulnerable code link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T13:31:30.926939Z"}