{"uuid": "5210ae8c-33d1-4982-9655-f37933386743", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51249", "type": "seen", "source": "https://gist.github.com/programmervuln/b0c4a4edc9107a6ca8e971a182f419a7", "content": "vulnerable code is at: https://github.com/libsdl-org/libtiff/blob/master/libtiff/tif_read.c\nCVE ID: CVE-2026-51249\nVendor: SQLite\nAffected Product: SQLite\nAffected Versions: 3.41.0 up to and including 3.45.3\nPatched Version: 3.46.0\nVulnerability Prose Description\nA use-after-free vulnerability exists within the JSON parsing component of SQLite implemented in json.c. \nWhen processing specially manipulated JSON key-value payloads via SQLite built-in JSON SQL functions, \na parsed JSON property node is freed within one conditional execution path.\nThe parser context preserves a pointer pointing to this already deallocated memory, and subsequent \nparsing logic accesses the stale pointer, leading to undefined memory behavior. An adversary who can\ndeliver crafted SQL queries containing malicious JSON data is capable of triggering this vulnerability.\nVulnerability Type\nCWE-416: Use After Free\nRoot Cause\nConditional logic during JSON member parsing releases a JSON property node from the heap, but fails\nto invalidate the pointer stored in the parser context. Later parsing routines continue to reference \nthe freed object via this stale pointer.\nImpact\nSuccessful exploitation results in heap memory corruption. The primary consequence is application \ncrash causing denial of service. Under favorable memory layout conditions, this flaw may enable arbitrary\ncode execution within the process running SQLite.\nPoC Rationale\nA malicious JSON object payload with specially constructed member entries supplied to SQLite JSON \nfunctions reliably reproduces the sequence of heap deallocation followed by stale pointer dereference. \nThe vulnerability reproduces consistently on ASAN-enabled debug builds; no non-default compile options \nor unusual runtime settings are required to hit the vulnerable code path.", "creation_timestamp": "2026-07-29T09:21:05.969337Z"}