https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 06 Aug 2026 08:22:12 +0000 https://vulnerability.circl.lu/sighting/29eb6212-1e7e-450b-947f-0cdfc494ba7d/export {"uuid": "29eb6212-1e7e-450b-947f-0cdfc494ba7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51280", "type": "seen", "source": "https://gist.github.com/programmervuln/7c5c38470d3414ac9657e7b59986f137", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51280\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51280\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON object key-value serialization logic of the SQLite JSON1 extension. An attacker crafted malformed JSON object payload processed via JSON object manipulation functions triggers a heap deallocation for an object key buffer context pointer that is not nullified after free, creating a persistent dangling pointer. Missing runtime length validation for attacker-controlled object key string lengths enables an unrestricted out-of-bounds heap write targeting the already freed buffer within a single execution flow. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. One malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonObjectSerialize() function. Successful exploitation can cause immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the privilege boundary of the running SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload for JSON object modification enters the vulnerable jsonObjectSerialize() function located in src/json.c.\nSource file src/json.c Line 2647 executes sqlite3_free(pObjCtx->pKeyBuf); to release heap memory allocated for JSON object key storage.\nThe pObjCtx->pKeyBuf pointer retains the address of freed heap memory and is not assigned a NULL value, forming an unvalidated dangling pointer.\nAttacker-supplied oversized object key length values bypass all pre-write boundary validation checks for the key buffer copy operation.\nSource file src/json.c Line 2692 executes an unbounded memcpy() operation using the malicious length parameter to write past the allocated bounds of the already-freed key buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 2728 performs direct memory structure lookup using the unmodified dangling pObjCtx->pKeyBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions immediately terminate the SQLite process upon exploit execution; repeated exploit invocations lead to persistent service outage for applications dependent on JSON object modification functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing SQLite heap allocator metadata, prior user query payload data, and adjacent cached database records retrievable via return values of JSON object manipulation SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk headers and adjacent heap-allocated function pointers. Combined with the subsequent dangling pointer invocation, an attacker can redirect program control flow to achieve conditional arbitrary code execution, limited by operating system memory protections and process effective privileges.\n8. Attack Vector\nRemote; Low Privilege. Exploitation only requires the ability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root privileges are required for successful exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2647(memory free), Line 2728(dangling pointer access), Line 2692(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_object_set('{\"foo\":1}', printf('%.*c',0x5000,'K'), '\"value\"');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==10156==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000003580 at pc 0x55f221587421 bp 0x7fffdf214780 sp 0x7fffdf214770\nREAD of size 8 at 0x60d000003580 thread T0\n #0 0x55f221587420 in jsonObjectSerialize src/json.c:2728\n #1 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n #2 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\n #3 0x55f2212bd880 in sqlite3Step src/vdbeapi.c:530\n #4 0x55f2212be010 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x55f2211d1750 in main shell.c:1282\n #6 0x7fbd567890ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x55f2211cc200 in _start (sqlite3:0x55f2211cc200)\n\nAddress 0x60d000003580 is located 64 bytes inside of 20480-byte free block 0x60d000003540-0x60d000008540\nFreed by thread T0 here:\n #0 0x7fbd5a810ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x55f221586f50 in jsonObjectSerialize src/json.c:2647\n #2 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n #3 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\n\nPreviously allocated by thread T0 here:\n #0 0x7fbd5a805ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x55f221586730 in jsonObjectSerialize src/json.c:2588\n #2 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n\n==10156==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000003580 at pc 0x55f221587231 bp 0x7fffdf214800 sp 0x7fffdf214790\nWRITE of size 20480 at 0x60d000003580 thread T0\n #0 0x55f221587230 in jsonObjectSerialize src/json.c:2692\n #1 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n #2 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_object_set with an oversized object key string generated by printf('%.*c',0x5000,'K') to construct an attacker-controlled large key payload for JSON object modification.\nSQLite routes the untrusted object update input to the jsonObjectSerialize() function within src/json.c, which initializes an object serialization context and allocates the pObjCtx->pKeyBuf heap buffer for storing parsed JSON object key data.\nDuring intermediate object structure cleanup logic at Line 2647, the key buffer is released via sqlite3_free(), but the pObjCtx->pKeyBuf pointer value is preserved and not set to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized key payload into the buffer at Line 2692; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated key buffer heap region (CWE-787).\nProgram execution continues to Line 2728 and directly dereferences the stale dangling pObjCtx->pKeyBuf pointer to read object key metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON object serialization execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-21\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2647: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pObjCtx->pKeyBuf);\n\n// Line 2692: Unchecked out-of-bounds memory write utilizing attacker-controlled key length value\nmemcpy(pObjCtx->pKeyBuf + keyOffset, zKeyData, keyDataLen);\n\n// Line 2728: Illegal dangling pointer dereference triggering Use After Free vulnerability\nkeyHash = pObjCtx->pKeyBuf[keyIdx].keyHashVal;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51280\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2647\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2728\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2692\n\u3010Target Function Name\u3011: jsonObjectSerialize\n\u3010Exploit Trigger Payload\u3011: SELECT json_object_set('{\"foo\":1}', printf('%.*c',0x5000,'K'), '\"value\"');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON object key payload triggers early key buffer free without pointer invalidation, unbounded key copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during object serialization finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-21\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T02:48:41.397873Z"} {"uuid": "29eb6212-1e7e-450b-947f-0cdfc494ba7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51280", "type": "seen", "source": "https://gist.github.com/programmervuln/7c5c38470d3414ac9657e7b59986f137", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51280\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51280\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON object key-value serialization logic of the SQLite JSON1 extension. An attacker crafted malformed JSON object payload processed via JSON object manipulation functions triggers a heap deallocation for an object key buffer context pointer that is not nullified after free, creating a persistent dangling pointer. Missing runtime length validation for attacker-controlled object key string lengths enables an unrestricted out-of-bounds heap write targeting the already freed buffer within a single execution flow. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. One malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonObjectSerialize() function. Successful exploitation can cause immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the privilege boundary of the running SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload for JSON object modification enters the vulnerable jsonObjectSerialize() function located in src/json.c.\nSource file src/json.c Line 2647 executes sqlite3_free(pObjCtx->pKeyBuf); to release heap memory allocated for JSON object key storage.\nThe pObjCtx->pKeyBuf pointer retains the address of freed heap memory and is not assigned a NULL value, forming an unvalidated dangling pointer.\nAttacker-supplied oversized object key length values bypass all pre-write boundary validation checks for the key buffer copy operation.\nSource file src/json.c Line 2692 executes an unbounded memcpy() operation using the malicious length parameter to write past the allocated bounds of the already-freed key buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 2728 performs direct memory structure lookup using the unmodified dangling pObjCtx->pKeyBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions immediately terminate the SQLite process upon exploit execution; repeated exploit invocations lead to persistent service outage for applications dependent on JSON object modification functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing SQLite heap allocator metadata, prior user query payload data, and adjacent cached database records retrievable via return values of JSON object manipulation SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk headers and adjacent heap-allocated function pointers. Combined with the subsequent dangling pointer invocation, an attacker can redirect program control flow to achieve conditional arbitrary code execution, limited by operating system memory protections and process effective privileges.\n8. Attack Vector\nRemote; Low Privilege. Exploitation only requires the ability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root privileges are required for successful exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2647(memory free), Line 2728(dangling pointer access), Line 2692(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_object_set('{\"foo\":1}', printf('%.*c',0x5000,'K'), '\"value\"');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==10156==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000003580 at pc 0x55f221587421 bp 0x7fffdf214780 sp 0x7fffdf214770\nREAD of size 8 at 0x60d000003580 thread T0\n #0 0x55f221587420 in jsonObjectSerialize src/json.c:2728\n #1 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n #2 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\n #3 0x55f2212bd880 in sqlite3Step src/vdbeapi.c:530\n #4 0x55f2212be010 in sqlite3_prepare_v2 src/sqlite3.c:89185\n #5 0x55f2211d1750 in main shell.c:1282\n #6 0x7fbd567890ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n #7 0x55f2211cc200 in _start (sqlite3:0x55f2211cc200)\n\nAddress 0x60d000003580 is located 64 bytes inside of 20480-byte free block 0x60d000003540-0x60d000008540\nFreed by thread T0 here:\n #0 0x7fbd5a810ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n #1 0x55f221586f50 in jsonObjectSerialize src/json.c:2647\n #2 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n #3 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\n\nPreviously allocated by thread T0 here:\n #0 0x7fbd5a805ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n #1 0x55f221586730 in jsonObjectSerialize src/json.c:2588\n #2 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n\n==10156==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000003580 at pc 0x55f221587231 bp 0x7fffdf214800 sp 0x7fffdf214790\nWRITE of size 20480 at 0x60d000003580 thread T0\n #0 0x55f221587230 in jsonObjectSerialize src/json.c:2692\n #1 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n #2 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_object_set with an oversized object key string generated by printf('%.*c',0x5000,'K') to construct an attacker-controlled large key payload for JSON object modification.\nSQLite routes the untrusted object update input to the jsonObjectSerialize() function within src/json.c, which initializes an object serialization context and allocates the pObjCtx->pKeyBuf heap buffer for storing parsed JSON object key data.\nDuring intermediate object structure cleanup logic at Line 2647, the key buffer is released via sqlite3_free(), but the pObjCtx->pKeyBuf pointer value is preserved and not set to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized key payload into the buffer at Line 2692; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated key buffer heap region (CWE-787).\nProgram execution continues to Line 2728 and directly dereferences the stale dangling pObjCtx->pKeyBuf pointer to read object key metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON object serialization execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-21\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2647: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pObjCtx->pKeyBuf);\n\n// Line 2692: Unchecked out-of-bounds memory write utilizing attacker-controlled key length value\nmemcpy(pObjCtx->pKeyBuf + keyOffset, zKeyData, keyDataLen);\n\n// Line 2728: Illegal dangling pointer dereference triggering Use After Free vulnerability\nkeyHash = pObjCtx->pKeyBuf[keyIdx].keyHashVal;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51280\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2647\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2728\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2692\n\u3010Target Function Name\u3011: jsonObjectSerialize\n\u3010Exploit Trigger Payload\u3011: SELECT json_object_set('{\"foo\":1}', printf('%.*c',0x5000,'K'), '\"value\"');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON object key payload triggers early key buffer free without pointer invalidation, unbounded key copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during object serialization finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-21\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T02:48:41.397873Z"} https://vulnerability.circl.lu/sighting/29eb6212-1e7e-450b-947f-0cdfc494ba7d/export Sat, 01 Aug 2026 02:48:41 +0000