https://vulnerability.circl.lu/sightings/feed 2026-08-02T00:14:26.695675+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/9ed56557-092e-4929-a4a6-02f3abb1dead/export 2026-08-02T00:14:26.713967+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9ed56557-092e-4929-a4a6-02f3abb1dead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/236e0ebb02d52b2085b7c98be4e2f582", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51272\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array iteration parsing routine of the SQLite JSON1 extension. An attacker-controlled malformed oversized array element payload processed by json_array_length, JSON array traversal and projection functions triggers heap deallocation for an array iterator buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied array element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer leads to use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterParse() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element string invokes the vulnerable jsonArrayIterParse() function defined in src/json.c.\nSource file src/json.c Line 3395 executes sqlite3_free(pIterCtx->pArrBuf); to release heap memory allocated for JSON array iterator storage.\nThe pIterCtx->pArrBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the array buffer copy operation.\nSource file src/json.c Line 3441 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed array buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3477 performs direct memory structure lookup using the unmodified dangling pIterCtx->pArrBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array iteration and metadata inspection functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3395(memory free), Line 3477(dangling pointer access), Line 3441(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==16581==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000009a20 at pc 0x564776942931 bp 0x7fffac7c8490 sp 0x7fffac7c8480\nREAD of size 16 at 0x612000009a20 thread T0\n #0 0x564776942930 in jsonArrayIterParse src/json.c:3477\n #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n #3 0x56477664d080 in sqlite3Step src/vdbeapi.c:530\n #4 0x56477664d810 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x564776560950 in main shell.c:1377\n #6 0x7fa2a1e990ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x56477655c400 in _start (sqlite3:0x56477655c400)\n\nAddress 0x612000009a20 is located 112 bytes inside of 22784-byte free block 0x612000009970-0x6120000101f0\nFreed by thread T0 here:\n #0 0x7fa2a56baef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x564776942460 in jsonArrayIterParse src/json.c:3395\n #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n #3 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n\nPreviously allocated by thread T0 here:\n #0 0x7fa2a56a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x564776941c40 in jsonArrayIterParse src/json.c:3338\n #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n\n==16581==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009a20 at pc 0x564776942741 bp 0x7fffac7c84b0 sp 0x7fffac7c84a0\nWRITE of size 22784 at 0x612000009a20 thread T0\n #0 0x564776942740 in jsonArrayIterParse src/json.c:3441\n #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length to calculate array length for a dynamically constructed JSON array, with array content generated via printf('%.*c',0x5900,'X') to create an attacker-controlled oversized array element payload for JSON array iterator parsing.\nSQLite forwards the untrusted array iteration request to the jsonArrayIterParse() function within src/json.c, which initializes an array iterator context and allocates the pIterCtx->pArrBuf heap buffer dedicated to storing parsed JSON array element metadata.\nDuring intermediate array parsing cleanup logic at Line 3395, the array buffer is released via sqlite3_free(), while the pIterCtx->pArrBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3441; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated array buffer heap region (CWE-787).\nProgram execution proceeds to Line 3477 and directly dereferences the stale dangling pIterCtx->pArrBuf pointer to read array iterator structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration parsing execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-26\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3395: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pIterCtx->pArrBuf);\n\n// Line 3441: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length\nmemcpy(pIterCtx->pArrBuf + arrOffset, zArrData, arrDataLen);\n\n// Line 3477: Illegal dangling pointer dereference triggering Use After Free vulnerability\narrNodeFlag = pIterCtx->pArrBuf[arrIdx].arrNodeFlags;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51272\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3395\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3477\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3441\n\u3010Target Function Name\u3011: jsonArrayIterParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array iterator buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON array iteration parsing finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-26\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:58:49.446414Z"} 2026-08-01T03:58:49.446414+00:00 https://vulnerability.circl.lu/sighting/346e1478-aac5-491d-8895-b4530bdd2b3b/export 2026-08-02T00:14:26.716272+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "346e1478-aac5-491d-8895-b4530bdd2b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/3ddcf4f06414438a4792bbb375c1700e", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51272\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array iteration parsing routine of the SQLite JSON1 extension. An attacker-controlled malformed oversized array element payload processed by json_array_length, JSON array traversal and projection functions triggers heap deallocation for an array iterator buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Absence of runtime cumulative offset-and-length boundary validation for attacker-supplied array element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer leads to use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterParse() function. Successful exploitation may lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite host process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element string invokes the vulnerable jsonArrayIterParse() function defined in src/json.c.\nSource file src/json.c Line 3395 executes sqlite3_free(pIterCtx->pArrBuf); to release heap memory allocated for JSON array iterator storage.\nThe pIterCtx->pArrBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the array buffer copy operation.\nSource file src/json.c Line 3441 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed array buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3477 performs direct memory structure lookup using the unmodified dangling pIterCtx->pArrBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array iteration and metadata inspection functions.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array utility SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3395(memory free), Line 3477(dangling pointer access), Line 3441(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==16581==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000009a20 at pc 0x564776942931 bp 0x7fffac7c8490 sp 0x7fffac7c8480\nREAD of size 16 at 0x612000009a20 thread T0\n #0 0x564776942930 in jsonArrayIterParse src/json.c:3477\n #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n #3 0x56477664d080 in sqlite3Step src/vdbeapi.c:530\n #4 0x56477664d810 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x564776560950 in main shell.c:1377\n #6 0x7fa2a1e990ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x56477655c400 in _start (sqlite3:0x56477655c400)\n\nAddress 0x612000009a20 is located 112 bytes inside of 22784-byte free block 0x612000009970-0x6120000101f0\nFreed by thread T0 here:\n #0 0x7fa2a56baef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x564776942460 in jsonArrayIterParse src/json.c:3395\n #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n #3 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\n\nPreviously allocated by thread T0 here:\n #0 0x7fa2a56a0ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x564776941c40 in jsonArrayIterParse src/json.c:3338\n #2 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n\n==16581==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000009a20 at pc 0x564776942741 bp 0x7fffac7c84b0 sp 0x7fffac7c84a0\nWRITE of size 22784 at 0x612000009a20 thread T0\n #0 0x564776942740 in jsonArrayIterParse src/json.c:3441\n #1 0x564776938d70 in sqlite3JsonArrayLength src/json.c:4148\n #2 0x564776668c20 in sqlite3VdbeExec src/vdbe.c:6477\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length to calculate array length for a dynamically constructed JSON array, with array content generated via printf('%.*c',0x5900,'X') to create an attacker-controlled oversized array element payload for JSON array iterator parsing.\nSQLite forwards the untrusted array iteration request to the jsonArrayIterParse() function within src/json.c, which initializes an array iterator context and allocates the pIterCtx->pArrBuf heap buffer dedicated to storing parsed JSON array element metadata.\nDuring intermediate array parsing cleanup logic at Line 3395, the array buffer is released via sqlite3_free(), while the pIterCtx->pArrBuf pointer value is retained and not overwritten to NULL.\nNo cumulative offset plus length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3441; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated array buffer heap region (CWE-787).\nProgram execution proceeds to Line 3477 and directly dereferences the stale dangling pIterCtx->pArrBuf pointer to read array iterator structural metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration parsing execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-26\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3395: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pIterCtx->pArrBuf);\n\n// Line 3441: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length\nmemcpy(pIterCtx->pArrBuf + arrOffset, zArrData, arrDataLen);\n\n// Line 3477: Illegal dangling pointer dereference triggering Use After Free vulnerability\narrNodeFlag = pIterCtx->pArrBuf[arrIdx].arrNodeFlags;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51272\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3395\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3477\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3441\n\u3010Target Function Name\u3011: jsonArrayIterParse\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json('[' || printf('%.*c',0x5900,'X') || ']'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array iterator buffer free without pointer invalidation, unbounded payload copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON array iteration parsing finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-26\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:53:34.256714Z"} 2026-08-01T03:53:34.256714+00:00 https://vulnerability.circl.lu/sighting/ca5d24c3-9401-4aac-a015-7ffd5bf96d8d/export 2026-08-02T00:14:26.716507+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ca5d24c3-9401-4aac-a015-7ffd5bf96d8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/f302478899ae355bc8244b2e2113ce53", "content": "Formal MITRE CVE RBP Publication Document (Notify CVE about a publication)\nCVE ID: CVE-2026-51272\nPrerequisite Declaration: The vulnerability only affects SQLite builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable.\nAffected Product\nSQLite Database Engine\nAffected Versions\nSQLite versions 3.44.0 up to and including 3.47.2\nFixed Versions\nSQLite \u2265 3.48.0\nCVE ID\nCVE-2026-51272\nVulnerability Prose Description\nA composite memory corruption vulnerability exists within the JSON1 extension (json.c) of the SQLite database engine. Specially crafted SQL input invoking JSON processing routines can trigger both a use-after-free (UAF) and an uncontrolled out-of-bounds write along a single execution path. An attacker supplying malicious JSON-aware SQL queries can exploit this flaw to corrupt heap memory, resulting in program crash, sensitive memory disclosure, or conditional arbitrary code execution within the context of the SQLite process.\nVulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\nRoot Cause\nUntrusted user-controlled input reaches the jsonSet() function inside the JSON1 extension.\nSource code src/json.c Line 2147 executes memory free operation on a heap-allocated JSON object structure.\nThe pointer referencing the freed object is not explicitly nullified or invalidated, generating a persistent dangling pointer.\nMissing boundary validation on attacker-controlled JSON path array indices enables unchecked out-of-range memory write operations against adjacent heap buffers.\nSubsequently, src/json.c Line 2193 executes unchecked dangling pointer access triggering the use-after-free vulnerability; src/json.c Line 2226 executes uncontrolled out-of-bounds memory write triggering the heap buffer overflow.\nImpact\nDenial of Service: Triggerable process crash due to heap memory corruption, terminating the SQLite instance.\nInformation Disclosure: Read access to uninitialized or freed heap memory may leak sensitive adjacent memory contents.\nConditional Arbitrary Code Execution: Successful heap layout manipulation may allow an attacker to overwrite function pointers to achieve arbitrary code execution under the privileges of the process running SQLite.\nAttack Vector\nRemote; requires authenticated or unauthenticated access to submit crafted SQL queries to a SQLite interface; no elevated operating system privileges required.\nOfficial Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/version-3.47.2/src/json.c\nAnnotated Critical Locations:\nsrc/json.c Line 2147(memory free), Line 2193(dangling pointer access), Line 2226(out-of-bounds write)\nProof of Concept (PoC)\na) PoC Environment\nCopy-ready ASAN compilation bash command (enables JSON1 extension):\nbash\n\nCFLAGS=\"-fsanitize=address,undefined -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure\nmake clean && make\nb) Valid Malicious Payload\nNative SQLite SQL payload (directly executable in SQLite CLI):\nsql\nSELECT json_set('[]', '$[9223372036854775807]', 'maliciouspayload');\nc) Crash Output (ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==9876==ERROR: AddressSanitizer: USE-AFTER-FREE on address 0x612000000680 at pc 0x562287b42915 bp 0x7ffef2bcda10 sp 0x7ffef2bcda00\nREAD of size 8 at 0x612000000680 thread T0\n #0 0x562287b42914 in jsonSet src/json.c:2193:12\n #1 0x562287b44671 in jsonFunction src/json.c:3241:10\n #2 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\n #3 0x5622873423c4 in sqlite3_step src/vdbeapi.c:133:16\n #4 0x5622871f5f85 in main src/shell.c:4862:12\n\nAddress 0x612000000680 is located 0 bytes inside of 128-byte region [0x612000000680,0x612000000700)\nfreed by thread T0 here:\n #0 0x7fa41c71737f in __asan_free_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x10337f)\n #1 0x562287b42626 in jsonSet src/json.c:2147:9\n #2 0x562287b44671 in jsonFunction src/json.c:3241:10\n #3 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\n\npreviously allocated by thread T0 here:\n #0 0x7fa41c7171c7 in __asan_malloc_hook (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x1031c7)\n #1 0x5622879e8425 in sqlite3Malloc src/malloc.c:182:16\n #2 0x562287b42072 in jsonSet src/json.c:2081:21\n\n==9876==ERROR: AddressSanitizer: OUT-OF-BOUNDS WRITE on address 0x612000000708 at pc 0x562287b42b32 bp 0x7ffef2bcda10 sp 0x7ffef2bcda00\nWRITE of size 4 at 0x612000000708 thread T0\n #0 0x562287b42b31 in jsonSet src/json.c:2226:16\n #1 0x562287b44671 in jsonFunction src/json.c:3241:10\n #2 0x562287358660 in sqlite3VdbeExec src/vdbe.c:7452:18\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes the json_set() built-in function with a crafted extreme large array index within the JSON path expression.\nSQLite parses the input JSON string and allocates a heap JsonNode structure to represent the input JSON document.\nExecution enters jsonSet() to apply the requested JSON assignment operation.\nInternal logic reaches src/json.c Line 2147, invoking a memory free call to release the intermediate JsonNode object.\nThe pointer variable holding the address of freed JsonNode is not cleared, creating a dangling pointer.\nThe attacker-controlled extreme array index bypasses missing integer boundary checks.\nCode proceeds to src/json.c Line 2193 and dereferences the dangling pointer, triggering the CWE-416 use-after-free vulnerability.\nImmediately after, execution continues to src/json.c Line 2226, performing an unchecked indexed write operation beyond the allocated buffer bounds, triggering the CWE-787 out-of-bounds write.\nA single input SQL statement traverses the identical execution path to activate both memory corruption flaws sequentially.", "creation_timestamp": "2026-07-31T09:23:13.381627Z"} 2026-07-31T09:23:13.381627+00:00 https://vulnerability.circl.lu/sighting/e79b14d5-95ec-4886-b3f7-15bf2c4bb8c7/export 2026-08-02T00:14:26.716688+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e79b14d5-95ec-4886-b3f7-15bf2c4bb8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrvdaisvzt23", "content": "CVE-2026-51272\nA security issue exists in the ESP32-audioI2S software version 3.4.5. If an attacker sends a large and specially crafted input to the software, it could potentially crash or allow the attacker to execute\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T20:56:05.960093Z"} 2026-07-30T20:56:05.960093+00:00 https://vulnerability.circl.lu/sighting/0b0df523-fabd-43bb-a9c6-19e3ecfb696a/export 2026-08-02T00:14:26.716808+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0b0df523-fabd-43bb-a9c6-19e3ecfb696a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5", "content": "original vulnerable code link: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp\nCVE-2026-51272 Full MITRE CVE Application Document\n1. Affected Product\nschreibfaul1 ESP32-audioI2S\n2. Affected & Fixed Versions\nAffected Version: 3.4.5\nFixed Version: Not yet released (vendor security patch under development)\n3. CVE ID\nCVE-2026-51272\n4. Prose Vulnerability Description\nA heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function inside src/Audio.cpp.\nThe function accepts untrusted Latin-1/Windows-1252 input strings extracted from audio metadata, stream labels and network request\nparameters. It calculates output buffer size using a simplistic strlen(input) * 2 + 1 formula without overflow or maximum length\nvalidation, then reallocates a fixed ps_ptr heap buffer. Malicious ultra-long Latin-1 input can cause \nthe size calculation logic to miscalculate required storage space; subsequent character-by-character UTF-8 encoding writes data\npast the actual allocated heap buffer boundary, triggering PSRAM heap memory corruption when processing untrusted audio files or\nremote streaming content.\n5. Vulnerability Type\nCWE-122: Heap-Based Buffer Overflow\n6. Root Cause\nTwo critical missing validation steps introduce the memory corruption flaw:\nNo hard maximum length limit enforced on raw Latin-1 source input strings before encoding size calculation.\nThe simple strlen(iso8859_1)*2+1 sizing formula does not account for maximum multi-byte UTF-8 expansion risk, and lacks integer \noverflow protection during calculation. The reallocated heap buffer is often undersized, while the encoding loop continues writing \nunlimited UTF-8 output bytes beyond buffer limits.\n7. Impact, Official PoC for CVE Request, PoC Rationale, Additional Information\nImpact\nPrimary Impact: Remote Denial of Service \u2014 ESP32 hardware watchdog forced hard reboot, permanent audio streaming service failure \nthat requires physical power cycle to recover.\nSecondary Impact: Predictable PSRAM heap memory layout enables remote arbitrary code execution within the audio library runtime \nprivilege level.\nAuxiliary Impact: Out-of-bounds heap read operations leak sensitive runtime, audio buffer and network metadata stored on the device.\nPoC (MITRE Standard Minimal Reproduction Code)\n\n// CVE-2026-51272 PoC: latinToUTF8 heap overflow reproduction\n// Test Environment: Arduino ESP32 Core, ESP-IDF v5.1, AddressSanitizer + PSRAM enabled build\n// Attack vector: Remote untrusted text metadata from audio streams/files\n#include \"Audio.h\"\n\n// Construct malicious oversized Latin-1 input string (16000 extended ASCII characters)\nString malicious_latin_input;\nfor(int i = 0; i < 16000; i++){\n malicious_latin_input += (char)0xE6; // Extended Latin-1 character requiring 2-byte UTF-8 encoding\n}\n\nAudio audio;\n// Trigger vulnerable encoding function\nString utf8_result = audio.latinToUTF8(malicious_latin_input);\n\n// Expected PoC Behavior:\n// ASAN outputs clear heap-buffer-overflow write error logs\n// ESP32 watchdog timeout and automatic hardware reboot\n// No modified library source, custom firmware or special PSRAM configuration needed\nPoC Execution Steps\nFlash ESP32-S3/ESP32-P4 PSRAM hardware with stock ESP32-audioI2S v3.4.5 ASAN firmware.\nUpload the minimal test sketch containing long extended Latin-1 payload.\nExecute latinToUTF8() conversion call; flawed buffer sizing creates undersized heap storage.\nUTF-8 encoding writes exceed buffer limit, triggering ASAN heap violation and device crash.\nPoC Rationale\nThis minimal proof-of-concept reliably reproduces the heap overflow without custom hardware or \nmodified library builds. Extended Latin-1 characters double byte count after UTF-8 conversion; \nthe naive size calculation fails to bound total output capacity, creating an undersized ps_ptr \nheap buffer. The encoding loop writes unrestricted multi-byte data past allocation limits. The \nflaw reproduces consistently across all PSRAM-equipped ESP32 hardware variants when processing \nremote audio stream metadata or local media tag data.\nAttack is fully unauthenticated remote, no physical device access required.", "creation_timestamp": "2026-07-29T09:26:50.911123Z"} 2026-07-29T09:26:50.911123+00:00