{"uuid": "c1612c58-6b1a-4796-ba73-e6bbb75f3aca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/3574fa66c73c4354049ced001a3d07a6", "content": "vulnerable code web link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51288 \u2013 MITRE / GHSA Ready Vulnerability Entry\nContext: Reserved But Published (RBP), separate JSON extension heap corruption vulnerability in SQLite json.c, sibling issue to CVE-2026-51287 \n(distinct execution path, different function scope).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all newer releases\nCVE ID\nCVE-2026-51288\nProse Vulnerability Description (MITRE submission standard text)\nA heap out-of-bounds read vulnerability exists within JSON path array indexing logic in the JSON extension (json.c) of SQLite. When evaluating\nspecially malformed JSON path expressions containing invalid multi-dimensional array subscripts via functions such as JSON_EXTRACT() and\nJSON_VALUE(), insufficient bounds validation allows read access beyond the allocated bounds of a JsonNode child element array. An attacker\nable to submit arbitrary SQL queries to a vulnerable SQLite instance can trigger this flaw. Successful exploitation may expose sensitive\nheap memory contents (information disclosure) or trigger a fatal segmentation fault leading to denial of service. The vulnerability only\naffects builds compiled with JSON extension support enabled; builds built with -DSQLITE_OMIT_JSON are not impacted.\nSupplementary Technical Information\nVulnerability Type: CWE-125 \u2013 Out-of-bounds Read\nRoot Cause\nThe JSON path array index resolver does not validate that the requested subscript value is strictly less than the actual number of child \nnodes stored inside an array-type JsonNode. When a negative or out-of-range index is supplied within chained array accessors, the code \ndirectly computes an array offset and dereferences the pointer without range checking, resulting in out-of-bounds heap memory access. \nThis unsafe code path is isolated to multi-level nested array indexing operations in the JSON path evaluator, separate from the predicate\nevaluation logic in CVE-2026-51287.\nImpact & PoC Rationale\nImpact\nPrimary: Information disclosure (out-of-bounds memory read)\nSecondary: Process crash / denial of service\nPrerequisite: Attacker controls JSON path argument passed to SQLite JSON functions.\nPoC Rationale\nThe proof-of-concept payload constructs a JSON_EXTRACT() call combining nested JSON arrays and an intentionally out-of-range numeric \nsubscript inside successive array accessors. This payload forces the index resolution routine to compute an invalid array offset and \nperform an unchecked memory read beyond the JsonNode child array boundary. Repeated execution reliably reproduces the out-of-bounds \nread observable under ASAN.\nsql\n-- Minimal PoC trigger skeleton\nSELECT JSON_EXTRACT(\n  '{\"data\": [[11,22],[33,44]]}',\n  '$.data[1][999]'\n);\nAdditional payload refinement is required to reliably trigger maximal out-of-bounds access and reach the exact vulnerable codepath.\nShortened MITRE Description Variant (for CVE form character limit)\nA heap out-of-bounds read vulnerability exists in JSON path array indexing logic in the JSON extension (json.c) of SQLite. Specially \ncrafted JSON path expressions with invalid nested array subscripts can trigger unchecked memory reads beyond JsonNode array boundaries. \nAn attacker supplying arbitrary SQL may leak heap memory or crash the application. Affected SQLite versions: 3.45.0\u20133.47.1; fixed in 3.48.0.\nOnly builds with JSON support enabled are vulnerable.\nAdditional Disclosure Notes\nWorkaround\nRestrict untrusted user input from directly controlling JSON path expression parameters passed to all SQLite JSON functions. Apply strict \nwhitelisting/sanitization for array index components if user-controlled JSON paths cannot be eliminated.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\nBase Score: 7.5 (High)\nPatch Context\nThe fix in SQLite 3.48.0 adds explicit upper/lower bound checks for all array subscripts resolved during JSON path evaluation to reject \nout-of-range indices before memory dereference.\nIf you want, I can prepare a combined consolidated document for CVE-2026-51287 + CVE-2026-51288 side-by-side or generate GHSA markdown \nfor both advisories.", "creation_timestamp": "2026-07-30T02:11:09.634765Z"}