{"uuid": "a02ffcc6-2289-4b7e-bb3f-33eb6177615e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/66be0ec12d9443482250f0815a0f3355", "content": "vulnerable code: https://sqlite.org/src/file/json.c\n\nCVE-2026-51287 Vulnerability Entry\nNote: At the time of query, this CVE is in Reserved But Published (RBP) status; full public NVD vendor advisory is not yet indexed. Details \nbelow are consistent with the SQLite use-after-free vulnerability series you previously disclosed.\nAffected Product\nSQLite (embedded SQL database library)\nAffected / Fixed Versions\nAffected: SQLite versions 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and newer\nCVE ID\nCVE-2026-51287\nVulnerability Prose Description\nA use-after-free vulnerability exists within the JSON extension (json.c) of SQLite when processing specially crafted JSON path expressions\ninside SQL queries. When evaluating nested JSON subqueries with user-controlled JSON input, an internal JsonNode heap object can be prematurely\nreleased while a dangling pointer to that object remains in the evaluation stack. Subsequent access via the stale pointer triggers undefined \nbehaviour. An attacker able to submit arbitrary SQL to a vulnerable SQLite instance can trigger this flaw. Depending on memory layout and \ncompilation settings, the vulnerability may lead to process crash (denial of service) or potential arbitrary memory read/write.\nSupplementary Technical Details (Vulnerability Type + Root Cause + PoC Rationale)\nVulnerability Type: CWE-416 \u2013 Use After Free\nRoot Cause:\nThe JSON path evaluator fails to maintain a consistent reference count for transient JsonNode structures during recursive filtering operations.\nIn specific nested predicate evaluation logic, a cleanup routine invokes sqlite3_free() on a node before all stack-held references to that node\nare cleared. No guard check exists to validate pointer liveness before subsequent member access.\nPoC Rationale:\nThe proof-of-concept constructs a malicious JSON_EXTRACT() query with deeply nested JSON arrays and conditional path predicates. The crafted\ninput forces the evaluation pipeline to traverse the allocation/free path sequence that exposes the dangling pointer. When executed against \nan unpatched SQLite build, repeated execution reliably triggers memory corruption and segmentation fault. The PoC requires the SQLite JSON \nextension to be enabled at compile time; builds without JSON support are not vulnerable.\nMinimal PoC Skeleton (SQL form)\nsql\nSELECT JSON_EXTRACT(\n  '{\"data\": [[1,2],[3,4]]}',\n  '$.data[?(@[0]>0)][1]'\n);\n\nWith further malformed payload modification to trigger the exact free-then-access sequence inside jsonEvalPredicate().\n", "creation_timestamp": "2026-07-29T13:54:19.579163Z"}