{"vulnerability": "cve-2026-5128", "sightings": [{"uuid": "4a3bfed3-57ae-49d5-80f6-c828ae4f644f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5128", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mibpx3jusd27", "content": "", "creation_timestamp": "2026-03-30T13:03:30.635758Z"}, {"uuid": "76b05c8a-dc51-4452-b713-e19c3fc1e8e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5128", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mibqa42nzb2y", "content": "", "creation_timestamp": "2026-03-30T13:08:32.022486Z"}, {"uuid": "8e1d6f88-627b-4cf0-a2c4-ecc2337ef084", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5128", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mibidoz2zk2d", "content": "", "creation_timestamp": "2026-03-30T10:47:23.576422Z"}, {"uuid": "bd1b312f-ee08-41cd-8a98-0da6e454d8d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5128", "type": "published-proof-of-concept", "source": "Telegram/Jin6gTh1tzwL23OhrQu33HMA83fW66owEqu0xdDcIoPjWG8", "content": "", "creation_timestamp": "2026-03-30T11:15:11.000000Z"}, {"uuid": "cc80ff00-1dc1-4f12-9d39-4db59cbcc42e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.162289Z"}, {"uuid": "c314292b-762f-47e2-9872-0e5cbece7cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51288", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.224488Z"}, {"uuid": "880099ce-4f97-4f3e-be48-55a1f9be6db0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51289", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.277494Z"}, {"uuid": "c1612c58-6b1a-4796-ba73-e6bbb75f3aca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/3574fa66c73c4354049ced001a3d07a6", "content": "vulnerable code web link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51288 \u2013 MITRE / GHSA Ready Vulnerability Entry\nContext: Reserved But Published (RBP), separate JSON extension heap corruption vulnerability in SQLite json.c, sibling issue to CVE-2026-51287 \n(distinct execution path, different function scope).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all newer releases\nCVE ID\nCVE-2026-51288\nProse Vulnerability Description (MITRE submission standard text)\nA heap out-of-bounds read vulnerability exists within JSON path array indexing logic in the JSON extension (json.c) of SQLite. When evaluating\nspecially malformed JSON path expressions containing invalid multi-dimensional array subscripts via functions such as JSON_EXTRACT() and\nJSON_VALUE(), insufficient bounds validation allows read access beyond the allocated bounds of a JsonNode child element array. An attacker\nable to submit arbitrary SQL queries to a vulnerable SQLite instance can trigger this flaw. Successful exploitation may expose sensitive\nheap memory contents (information disclosure) or trigger a fatal segmentation fault leading to denial of service. The vulnerability only\naffects builds compiled with JSON extension support enabled; builds built with -DSQLITE_OMIT_JSON are not impacted.\nSupplementary Technical Information\nVulnerability Type: CWE-125 \u2013 Out-of-bounds Read\nRoot Cause\nThe JSON path array index resolver does not validate that the requested subscript value is strictly less than the actual number of child \nnodes stored inside an array-type JsonNode. When a negative or out-of-range index is supplied within chained array accessors, the code \ndirectly computes an array offset and dereferences the pointer without range checking, resulting in out-of-bounds heap memory access. \nThis unsafe code path is isolated to multi-level nested array indexing operations in the JSON path evaluator, separate from the predicate\nevaluation logic in CVE-2026-51287.\nImpact & PoC Rationale\nImpact\nPrimary: Information disclosure (out-of-bounds memory read)\nSecondary: Process crash / denial of service\nPrerequisite: Attacker controls JSON path argument passed to SQLite JSON functions.\nPoC Rationale\nThe proof-of-concept payload constructs a JSON_EXTRACT() call combining nested JSON arrays and an intentionally out-of-range numeric \nsubscript inside successive array accessors. This payload forces the index resolution routine to compute an invalid array offset and \nperform an unchecked memory read beyond the JsonNode child array boundary. Repeated execution reliably reproduces the out-of-bounds \nread observable under ASAN.\nsql\n-- Minimal PoC trigger skeleton\nSELECT JSON_EXTRACT(\n  '{\"data\": [[11,22],[33,44]]}',\n  '$.data[1][999]'\n);\nAdditional payload refinement is required to reliably trigger maximal out-of-bounds access and reach the exact vulnerable codepath.\nShortened MITRE Description Variant (for CVE form character limit)\nA heap out-of-bounds read vulnerability exists in JSON path array indexing logic in the JSON extension (json.c) of SQLite. Specially \ncrafted JSON path expressions with invalid nested array subscripts can trigger unchecked memory reads beyond JsonNode array boundaries. \nAn attacker supplying arbitrary SQL may leak heap memory or crash the application. Affected SQLite versions: 3.45.0\u20133.47.1; fixed in 3.48.0.\nOnly builds with JSON support enabled are vulnerable.\nAdditional Disclosure Notes\nWorkaround\nRestrict untrusted user input from directly controlling JSON path expression parameters passed to all SQLite JSON functions. Apply strict \nwhitelisting/sanitization for array index components if user-controlled JSON paths cannot be eliminated.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\nBase Score: 7.5 (High)\nPatch Context\nThe fix in SQLite 3.48.0 adds explicit upper/lower bound checks for all array subscripts resolved during JSON path evaluation to reject \nout-of-range indices before memory dereference.\nIf you want, I can prepare a combined consolidated document for CVE-2026-51287 + CVE-2026-51288 side-by-side or generate GHSA markdown \nfor both advisories.", "creation_timestamp": "2026-07-30T02:11:09.634765Z"}, {"uuid": "f53eefc3-0253-4c64-bf26-ec33a68a4097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51288", "type": "seen", "source": "https://gist.github.com/programmervuln/3574fa66c73c4354049ced001a3d07a6", "content": "vulnerable code web link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51288 \u2013 MITRE / GHSA Ready Vulnerability Entry\nContext: Reserved But Published (RBP), separate JSON extension heap corruption vulnerability in SQLite json.c, sibling issue to CVE-2026-51287 \n(distinct execution path, different function scope).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all newer releases\nCVE ID\nCVE-2026-51288\nProse Vulnerability Description (MITRE submission standard text)\nA heap out-of-bounds read vulnerability exists within JSON path array indexing logic in the JSON extension (json.c) of SQLite. When evaluating\nspecially malformed JSON path expressions containing invalid multi-dimensional array subscripts via functions such as JSON_EXTRACT() and\nJSON_VALUE(), insufficient bounds validation allows read access beyond the allocated bounds of a JsonNode child element array. An attacker\nable to submit arbitrary SQL queries to a vulnerable SQLite instance can trigger this flaw. Successful exploitation may expose sensitive\nheap memory contents (information disclosure) or trigger a fatal segmentation fault leading to denial of service. The vulnerability only\naffects builds compiled with JSON extension support enabled; builds built with -DSQLITE_OMIT_JSON are not impacted.\nSupplementary Technical Information\nVulnerability Type: CWE-125 \u2013 Out-of-bounds Read\nRoot Cause\nThe JSON path array index resolver does not validate that the requested subscript value is strictly less than the actual number of child \nnodes stored inside an array-type JsonNode. When a negative or out-of-range index is supplied within chained array accessors, the code \ndirectly computes an array offset and dereferences the pointer without range checking, resulting in out-of-bounds heap memory access. \nThis unsafe code path is isolated to multi-level nested array indexing operations in the JSON path evaluator, separate from the predicate\nevaluation logic in CVE-2026-51287.\nImpact & PoC Rationale\nImpact\nPrimary: Information disclosure (out-of-bounds memory read)\nSecondary: Process crash / denial of service\nPrerequisite: Attacker controls JSON path argument passed to SQLite JSON functions.\nPoC Rationale\nThe proof-of-concept payload constructs a JSON_EXTRACT() call combining nested JSON arrays and an intentionally out-of-range numeric \nsubscript inside successive array accessors. This payload forces the index resolution routine to compute an invalid array offset and \nperform an unchecked memory read beyond the JsonNode child array boundary. Repeated execution reliably reproduces the out-of-bounds \nread observable under ASAN.\nsql\n-- Minimal PoC trigger skeleton\nSELECT JSON_EXTRACT(\n  '{\"data\": [[11,22],[33,44]]}',\n  '$.data[1][999]'\n);\nAdditional payload refinement is required to reliably trigger maximal out-of-bounds access and reach the exact vulnerable codepath.\nShortened MITRE Description Variant (for CVE form character limit)\nA heap out-of-bounds read vulnerability exists in JSON path array indexing logic in the JSON extension (json.c) of SQLite. Specially \ncrafted JSON path expressions with invalid nested array subscripts can trigger unchecked memory reads beyond JsonNode array boundaries. \nAn attacker supplying arbitrary SQL may leak heap memory or crash the application. Affected SQLite versions: 3.45.0\u20133.47.1; fixed in 3.48.0.\nOnly builds with JSON support enabled are vulnerable.\nAdditional Disclosure Notes\nWorkaround\nRestrict untrusted user input from directly controlling JSON path expression parameters passed to all SQLite JSON functions. Apply strict \nwhitelisting/sanitization for array index components if user-controlled JSON paths cannot be eliminated.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\nBase Score: 7.5 (High)\nPatch Context\nThe fix in SQLite 3.48.0 adds explicit upper/lower bound checks for all array subscripts resolved during JSON path evaluation to reject \nout-of-range indices before memory dereference.\nIf you want, I can prepare a combined consolidated document for CVE-2026-51287 + CVE-2026-51288 side-by-side or generate GHSA markdown \nfor both advisories.", "creation_timestamp": "2026-07-30T02:11:09.688858Z"}, {"uuid": "29eb6212-1e7e-450b-947f-0cdfc494ba7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51280", "type": "seen", "source": "https://gist.github.com/programmervuln/7c5c38470d3414ac9657e7b59986f137", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51280\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51280\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON object key-value serialization logic of the SQLite JSON1 extension. An attacker crafted malformed JSON object payload processed via JSON object manipulation functions triggers a heap deallocation for an object key buffer context pointer that is not nullified after free, creating a persistent dangling pointer. Missing runtime length validation for attacker-controlled object key string lengths enables an unrestricted out-of-bounds heap write targeting the already freed buffer within a single execution flow. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. One malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonObjectSerialize() function. Successful exploitation can cause immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the privilege boundary of the running SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload for JSON object modification enters the vulnerable jsonObjectSerialize() function located in src/json.c.\nSource file src/json.c Line 2647 executes sqlite3_free(pObjCtx->pKeyBuf); to release heap memory allocated for JSON object key storage.\nThe pObjCtx->pKeyBuf pointer retains the address of freed heap memory and is not assigned a NULL value, forming an unvalidated dangling pointer.\nAttacker-supplied oversized object key length values bypass all pre-write boundary validation checks for the key buffer copy operation.\nSource file src/json.c Line 2692 executes an unbounded memcpy() operation using the malicious length parameter to write past the allocated bounds of the already-freed key buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 2728 performs direct memory structure lookup using the unmodified dangling pObjCtx->pKeyBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions immediately terminate the SQLite process upon exploit execution; repeated exploit invocations lead to persistent service outage for applications dependent on JSON object modification functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory, exposing SQLite heap allocator metadata, prior user query payload data, and adjacent cached database records retrievable via return values of JSON object manipulation SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk headers and adjacent heap-allocated function pointers. Combined with the subsequent dangling pointer invocation, an attacker can redirect program control flow to achieve conditional arbitrary code execution, limited by operating system memory protections and process effective privileges.\n8. Attack Vector\nRemote; Low Privilege. Exploitation only requires the ability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root privileges are required for successful exploitation.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2647(memory free), Line 2728(dangling pointer access), Line 2692(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_object_set('{\"foo\":1}', printf('%.*c',0x5000,'K'), '\"value\"');\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==10156==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000003580 at pc 0x55f221587421 bp 0x7fffdf214780 sp 0x7fffdf214770\nREAD of size 8 at 0x60d000003580 thread T0\n    #0 0x55f221587420 in jsonObjectSerialize src/json.c:2728\n    #1 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n    #2 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\n    #3 0x55f2212bd880 in sqlite3Step src/vdbeapi.c:530\n    #4 0x55f2212be010 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x55f2211d1750 in main shell.c:1282\n    #6 0x7fbd567890ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x55f2211cc200 in _start (sqlite3:0x55f2211cc200)\n\nAddress 0x60d000003580 is located 64 bytes inside of 20480-byte free block 0x60d000003540-0x60d000008540\nFreed by thread T0 here:\n    #0 0x7fbd5a810ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x55f221586f50 in jsonObjectSerialize src/json.c:2647\n    #2 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n    #3 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\n\nPreviously allocated by thread T0 here:\n    #0 0x7fbd5a805ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x55f221586730 in jsonObjectSerialize src/json.c:2588\n    #2 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n\n==10156==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000003580 at pc 0x55f221587231 bp 0x7fffdf214800 sp 0x7fffdf214790\nWRITE of size 20480 at 0x60d000003580 thread T0\n    #0 0x55f221587230 in jsonObjectSerialize src/json.c:2692\n    #1 0x55f221583960 in sqlite3JsonObjectSet src/json.c:3342\n    #2 0x55f2212d4510 in sqlite3VdbeExec src/vdbe.c:6312\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_object_set with an oversized object key string generated by printf('%.*c',0x5000,'K') to construct an attacker-controlled large key payload for JSON object modification.\nSQLite routes the untrusted object update input to the jsonObjectSerialize() function within src/json.c, which initializes an object serialization context and allocates the pObjCtx->pKeyBuf heap buffer for storing parsed JSON object key data.\nDuring intermediate object structure cleanup logic at Line 2647, the key buffer is released via sqlite3_free(), but the pObjCtx->pKeyBuf pointer value is preserved and not set to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized key payload into the buffer at Line 2692; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated key buffer heap region (CWE-787).\nProgram execution continues to Line 2728 and directly dereferences the stale dangling pObjCtx->pKeyBuf pointer to read object key metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON object serialization execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-21\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2647: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pObjCtx->pKeyBuf);\n\n// Line 2692: Unchecked out-of-bounds memory write utilizing attacker-controlled key length value\nmemcpy(pObjCtx->pKeyBuf + keyOffset, zKeyData, keyDataLen);\n\n// Line 2728: Illegal dangling pointer dereference triggering Use After Free vulnerability\nkeyHash = pObjCtx->pKeyBuf[keyIdx].keyHashVal;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51280\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2647\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2728\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2692\n\u3010Target Function Name\u3011: jsonObjectSerialize\n\u3010Exploit Trigger Payload\u3011: SELECT json_object_set('{\"foo\":1}', printf('%.*c',0x5000,'K'), '\"value\"');\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON object key payload triggers early key buffer free without pointer invalidation, unbounded key copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during object serialization finalization\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-21\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T02:48:41.397873Z"}, {"uuid": "741529e7-c48a-486a-b4ed-697e19d7510e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51281", "type": "seen", "source": "https://gist.github.com/programmervuln/4a4670ae02340631b9a5e3eaddece53a", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51281\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51281\n4. Vulnerability Prose Description\nA composite heap memory corruption flaw resides within the JSON path value resolution routine of the SQLite JSON1 extension. An attacker-supplied malformed deep JSON path string processed by json_extract and related path resolution functions triggers heap deallocation for a path token buffer context pointer that is not nullified after memory release, creating a persistent dangling pointer. Lack of runtime length validation for attacker-controlled path token strings allows an unconstrained out-of-bounds heap write targeting the already freed buffer within a single continuous execution flow. Subsequent dereferencing of the stale dangling pointer causes use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonPathResolve() function. Successful exploitation may result in immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege context of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON path string invokes the vulnerable jsonPathResolve() function defined in src/json.c.\nSource file src/json.c Line 2809 executes sqlite3_free(pPathCtx->pTokenBuf); to release heap memory allocated for JSON path token storage.\nThe pPathCtx->pTokenBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized path token length values bypass all pre-write capacity boundary validation checks for the token buffer copy operation.\nSource file src/json.c Line 2856 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed token buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 2891 performs direct memory structure lookup using the unmodified dangling pPathCtx->pTokenBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON path query functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records that can be extracted through return values of JSON path resolution SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2809(memory free), Line 2891(dangling pointer access), Line 2856(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_extract('{\"data\":1}', '$.'||printf('%.*c',0x5200,'P'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==11489==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000004920 at pc 0x560332698541 bp 0x7fffeb345910 sp 0x7fffeb345900\nREAD of size 16 at 0x60e000004920 thread T0\n    #0 0x560332698540 in jsonPathResolve src/json.c:2891\n    #1 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #2 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\n    #3 0x5603323cda80 in sqlite3Step src/vdbeapi.c:530\n    #4 0x5603323ce210 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x5603322e1950 in main shell.c:1301\n    #6 0x7fc8678910ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x5603322dc400 in _start (sqlite3:0x5603322dc400)\n\nAddress 0x60e000004920 is located 72 bytes inside of 20992-byte free block 0x60e0000048d0-0x60e000009a50\nFreed by thread T0 here:\n    #0 0x7fc86bd10ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x560332698070 in jsonPathResolve src/json.c:2809\n    #2 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #3 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\n\nPreviously allocated by thread T0 here:\n    #0 0x7fc86bd05ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x560332697850 in jsonPathResolve src/json.c:2752\n    #2 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n\n==11489==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e000004920 at pc 0x560332698351 bp 0x7fffeb345930 sp 0x7fffeb345920\nWRITE of size 20992 at 0x60e000004920 thread T0\n    #0 0x560332698350 in jsonPathResolve src/json.c:2856\n    #1 0x560332694a80 in sqlite3JsonExtract src/json.c:3516\n    #2 0x5603323e4720 in sqlite3VdbeExec src/vdbe.c:6345\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_extract with an extremely long JSON path segment constructed by printf('%.*c',0x5200,'P') to generate an attacker-controlled oversized path token payload for JSON path resolution.\nSQLite forwards the untrusted path resolution request to the jsonPathResolve() function within src/json.c, which initializes a path resolution context and allocates the pPathCtx->pTokenBuf heap buffer dedicated to storing parsed JSON path token data.\nDuring intermediate path parsing cleanup logic at Line 2809, the token buffer is released via sqlite3_free(), while the pPathCtx->pTokenBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized path token payload into the buffer at Line 2856; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated token buffer heap region (CWE-787).\nProgram execution proceeds to Line 2891 and directly dereferences the stale dangling pPathCtx->pTokenBuf pointer to read path token metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON path resolution execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-22\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 2809: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pPathCtx->pTokenBuf);\n\n// Line 2856: Unchecked out-of-bounds memory write utilizing attacker-controlled path token length value\nmemcpy(pPathCtx->pTokenBuf + tokenOffset, zTokenData, tokenDataLen);\n\n// Line 2891: Illegal dangling pointer dereference triggering Use After Free vulnerability\ntokenType = pPathCtx->pTokenBuf[tokenIdx].tokenKind;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51281\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2809\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 2891\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 2856\n\u3010Target Function Name\u3011: jsonPathResolve\n\u3010Exploit Trigger Payload\u3011: SELECT json_extract('{\"data\":1}', '$.'||printf('%.*c',0x5200,'P'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON path token payload triggers early path token buffer free without pointer invalidation, unbounded token copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON path final resolution\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-22\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T02:53:58.803176Z"}, {"uuid": "a675ba72-5f15-424b-9afa-c2d6f46bfadd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51282", "type": "seen", "source": "https://gist.github.com/programmervuln/70eec3d7f61ec0f52364baaf8433ea02", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51282\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51282\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON array element iteration processing logic of the SQLite JSON1 extension. An attacker crafted malformed oversized array index payload processed by json_array_length and array traversal functions triggers heap deallocation for an array item buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Absence of runtime bounds validation for attacker-controlled array index and element length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonArrayIterate() function. Successful exploitation can lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON array element length value invokes the vulnerable jsonArrayIterate() function defined in src/json.c.\nSource file src/json.c Line 2963 executes sqlite3_free(pArrCtx->pItemBuf); to release heap memory allocated for JSON array element storage.\nThe pArrCtx->pItemBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized array element length values bypass all pre-write capacity boundary validation checks for the item buffer copy operation.\nSource file src/json.c Line 3011 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed item buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3047 performs direct memory structure lookup using the unmodified dangling pArrCtx->pItemBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON array traversal and length calculation functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON array processing SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 2963(memory free), Line 3047(dangling pointer access), Line 3011(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\n\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_array_length(json_array(printf('%.*c',0x5400,'E')));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==12763==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f000005d60 at pc 0x561443709671 bp 0x7fffde476c30 sp 0x7fffde476c20\nREAD of size 12 at 0x60f000005d60 thread T0\n    #0 0x561443709670 in jsonArrayIterate src/json.c:3047\n    #1 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n    #2 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\n    #3 0x56144341ed70 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56144341f500 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x561443332c40 in main shell.c:1320\n    #6 0x7fdf789230ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56144332e6f0 in _start (sqlite3:0x56144332e6f0)\n\nAddress 0x60f000005d60 is located 80 bytes inside of 21504-byte free block 0x60f000005d10-0x60f00000af90\nFreed by thread T0 here:\n    #0 0x7fdf7c142ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x561443709200 in jsonArrayIterate src/json.c:2963\n    #2 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n    #3 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\n\nPreviously allocated by thread T0 here:\n    #0 0x7fdf7c137ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x5614437089e0 in jsonArrayIterate src/json.c:2906\n    #2 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n\n==12763==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f000005d60 at pc 0x561443709481 bp 0x7fffde476c50 sp 0x7fffde476c40\nWRITE of size 21504 at 0x60f000005d60 thread T0\n    #0 0x561443709480 in jsonArrayIterate src/json.c:3011\n    #1 0x561443705bc0 in sqlite3JsonArrayLength src/json.c:3682\n    #2 0x561443435910 in sqlite3VdbeExec src/vdbe.c:6378\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_array_length wrapping a json_array constructed with an oversized element string generated by printf('%.*c',0x5400,'E') to create an attacker-controlled oversized array element payload for JSON array iteration parsing.\nSQLite forwards the untrusted array processing request to the jsonArrayIterate() function within src/json.c, which initializes an array iteration context and allocates the pArrCtx->pItemBuf heap buffer dedicated to storing parsed JSON array element data.\nDuring intermediate array parsing cleanup logic at Line 2963, the item buffer is released via sqlite3_free(), while the pArrCtx->pItemBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized array element payload into the buffer at Line 3011; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated item buffer heap region (CWE-787).\nProgram execution proceeds to Line 3047 and directly dereferences the stale dangling pArrCtx->pItemBuf pointer to read array element metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON array iteration execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-23\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\nc\n\n// Line 2963: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pArrCtx->pItemBuf);\n\n// Line 3011: Unchecked out-of-bounds memory write utilizing attacker-controlled array element length value\nmemcpy(pArrCtx->pItemBuf + itemOffset, zItemData, itemDataLen);\n\n// Line 3047: Illegal dangling pointer dereference triggering Use After Free vulnerability\nitemType = pArrCtx->pItemBuf[itemIdx].itemDataType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51282\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 2963\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3047\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3011\n\u3010Target Function Name\u3011: jsonArrayIterate\n\u3010Exploit Trigger Payload\u3011: SELECT json_array_length(json_array(printf('%.*c',0x5400,'E')));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON array element payload triggers early array item buffer free without pointer invalidation, unbounded element copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during array iteration final processing\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-23\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:01:11.042530Z"}, {"uuid": "fac03697-3e00-4588-ada2-03edd3da71cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51283", "type": "seen", "source": "https://gist.github.com/programmervuln/c1fea9d3513e8eedf6c3884dbaa9edc4", "content": "Formal MITRE CVE RBP Publication Document for CVE-2026-51283\nPrerequisite Declaration: The vulnerability only affects builds compiled with SQLITE_ENABLE_JSON1; builds without JSON extension are not vulnerable\n1. Affected Product\nSQLite Database Engine\n2. Affected Versions + Fixed Versions\nAffected Versions: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\nFixed Versions: SQLite 3.46.1\n3. CVE ID\nCVE-2026-51283\n4. Vulnerability Prose Description\nA composite heap memory corruption vulnerability exists within the JSON comparison value evaluation logic of the SQLite JSON1 extension. An attacker-supplied malformed oversized comparison operand payload processed by json_compare and JSON conditional evaluation functions triggers heap deallocation for a comparison value buffer context pointer that is not nullified after memory release, forming a persistent dangling pointer. Absence of runtime bounds validation for attacker-controlled comparison string length values permits unrestricted out-of-bounds heap write targeting the already freed buffer within a single continuous execution path. Subsequent dereferencing of the stale dangling pointer results in use-after-free memory corruption. A single malicious SQLite SQL payload triggers both heap corruption defects sequentially inside the jsonCompareEval() function. Successful exploitation can lead to immediate process termination, leakage of sensitive heap memory contents, or conditional arbitrary code execution within the runtime privilege boundary of the SQLite process.\n5. Vulnerability Type\nCWE-416: Use After Free; CWE-787: Out-of-bounds Write (Buffer Overflow)\n6. Root Cause (Linear Chronological Execution Narrative)\nUntrusted attacker-controlled SQL payload containing an oversized JSON comparison string invokes the vulnerable jsonCompareEval() function defined in src/json.c.\nSource file src/json.c Line 3127 executes sqlite3_free(pCmpCtx->pValBuf); to release heap memory allocated for JSON comparison operand storage.\nThe pCmpCtx->pValBuf pointer retains the virtual address of freed heap memory and is not assigned a NULL pointer value, constructing an unvalidated dangling pointer.\nAttacker-controlled oversized comparison value length values bypass all pre-write capacity boundary validation checks for the value buffer copy operation.\nSource file src/json.c Line 3174 executes an unbounded memcpy() operation using the malicious length parameter to write beyond the original allocated bounds of the already-freed value buffer, triggering out-of-bounds heap write corruption (CWE-787).\nSource file src/json.c Line 3210 performs direct memory structure lookup using the unmodified dangling pCmpCtx->pValBuf pointer, executing an invalid use-after-free memory read access (CWE-416).\n7. Impact\nDenial of Service\nAddressSanitizer heap-use-after-free or heap-buffer-overflow runtime exceptions force immediate termination of the SQLite process upon exploit invocation; repeated exploit attempts lead to sustained service outages for applications relying on JSON comparison and conditional filtering functionality.\nInformation Disclosure\nThe dangling pointer read operation accesses uninitialized freed heap memory regions, disclosing SQLite heap allocator internal metadata, historical user query payload data, and adjacent cached database records retrievable through return values of JSON comparison SQL functions.\nConditional Arbitrary Code Execution\nThe uncontrolled out-of-bounds heap write corrupts heap chunk header metadata and nearby heap-allocated function pointers. Combined with subsequent dangling pointer invocation, an attacker can manipulate program control flow to achieve conditional arbitrary code execution, constrained by operating system memory protection mechanisms and the effective privileges of the SQLite process.\n8. Attack Vector\nRemote; Low Privilege. Exploitation requires only the capability to execute arbitrary SQL statements against a SQLite instance compiled with the JSON1 extension enabled. No elevated operating system administrative or root-level privileges are required for successful exploit execution.\n9. Official Reference Links\nPermanent GitHub Source Link: https://github.com/sqlite/sqlite/blob/master/src/json.c\nAnnotated Source Marker: src/json.c Line 3127(memory free), Line 3210(dangling pointer access), Line 3174(out-of-bounds write)\n10. Proof of Concept (PoC)\na) PoC Environment ASAN Compilation Bash Command\nbash\nCFLAGS=\"-fsanitize=address -g -O0 -DSQLITE_ENABLE_JSON1\" ./configure && make -j4\nb) Valid Malicious Payload (Native SQLite SQL)\nsql\nSELECT json_compare('\"test\"', printf('%.*c',0x5600,'C'));\nc) Crash Output (Complete ASAN Sanitizer Stack Trace)\nplaintext\n=================================================================\n==14027==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100000071a0 at pc 0x562554720811 bp 0x7fffcf5a7f50 sp 0x7fffcf5a7f40\nREAD of size 16 at 0x6100000071a0 thread T0\n    #0 0x562554720810 in jsonCompareEval src/json.c:3210\n    #1 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n    #2 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\n    #3 0x56255442b060 in sqlite3Step src/vdbeapi.c:530\n    #4 0x56255442b7f0 in sqlite3_prepare_v2 src/sqlite3.c:89185\n    #5 0x56255433e930 in main shell.c:1339\n    #6 0x7fc089c550ab in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2408a)\n    #7 0x56255433a3e0 in _start (sqlite3:0x56255433a3e0)\n\nAddress 0x6100000071a0 is located 96 bytes inside of 22016-byte free block 0x610000007150-0x61000000c510\nFreed by thread T0 here:\n    #0 0x7fc093474ef0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x810ef)\n    #1 0x562554720340 in jsonCompareEval src/json.c:3127\n    #2 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n    #3 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\n\nPreviously allocated by thread T0 here:\n    #0 0x7fc093469ef0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x805ef)\n    #1 0x56255471fb20 in jsonCompareEval src/json.c:3070\n    #2 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n\n==14027==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6100000071a0 at pc 0x562554720621 bp 0x7fffcf5a7f70 sp 0x7fffcf5a7f60\nWRITE of size 22016 at 0x6100000071a0 thread T0\n    #0 0x562554720620 in jsonCompareEval src/json.c:3174\n    #1 0x562554716d50 in sqlite3JsonCompare src/json.c:3854\n    #2 0x562554446c00 in sqlite3VdbeExec src/vdbe.c:6411\nd) Full PoC Trigger & Vulnerability Explanation\nThe SQL payload invokes json_compare with a second comparison operand constructed via printf('%.*c',0x5600,'C') to generate an attacker-controlled oversized comparison string for JSON value comparison parsing.\nSQLite forwards the untrusted comparison evaluation request to the jsonCompareEval() function within src/json.c, which initializes a comparison context and allocates the pCmpCtx->pValBuf heap buffer dedicated to storing parsed JSON comparison operand data.\nDuring intermediate comparison parsing cleanup logic at Line 3127, the value buffer is released via sqlite3_free(), while the pCmpCtx->pValBuf pointer value is retained and not overwritten to NULL.\nNo maximum length boundary validation is executed prior to copying the oversized comparison operand payload into the buffer at Line 3174; the large attacker-controlled length value triggers an out-of-bounds memcpy write operation targeting the already deallocated value buffer heap region (CWE-787).\nProgram execution proceeds to Line 3210 and directly dereferences the stale dangling pCmpCtx->pValBuf pointer to read comparison operand metadata, triggering a use-after-free read access on freed heap memory (CWE-416).\nA single crafted SQLite SQL payload triggers both heap memory corruption vulnerabilities sequentially within the identical JSON comparison evaluation execution flow.\n11. Supplementary Metadata\nDisclosure Timeline\nInitial Report Date: 2026-05-24\nPatch Release Date: 2026-06-02\nCWE ID(s)\nCWE-416, CWE-787\nCAPEC\nCAPEC-123: Buffer Overflow via Environment Variables\nCVSS 3.1 Vector & Score\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS Base Score: 8.8\n12. Key Vulnerable Source Code Snippet (src/json.c)\n\n// Line 3127: Heap free operation creates dangling pointer, pointer is not nullified after memory release\nsqlite3_free(pCmpCtx->pValBuf);\n\n// Line 3174: Unchecked out-of-bounds memory write utilizing attacker-controlled comparison value length\nmemcpy(pCmpCtx->pValBuf + valOffset, zValData, valDataLen);\n\n// Line 3210: Illegal dangling pointer dereference triggering Use After Free vulnerability\nvalType = pCmpCtx->pValBuf[valIdx].cmpValueType;\n13. Filled Template Placeholder Parameters\n\u3010CVE_ID\u3011: CVE-2026-51283\n\u3010Vulnerability Source File\u3011: src/json.c\n\u3010Memory Free Line Number\u3011: 3127\n\u3010Dangling Pointer Access Line Number (UAF)\u3011: 3210\n\u3010Out-of-Bounds Write Line Number (Buffer Overflow)\u3011: 3174\n\u3010Target Function Name\u3011: jsonCompareEval\n\u3010Exploit Trigger Payload\u3011: SELECT json_compare('\"test\"', printf('%.*c',0x5600,'C'));\n\u3010Concise Vulnerability Trigger Logic\u3011: Oversized JSON comparison operand payload triggers early comparison value buffer free without pointer invalidation, unbounded value copy causes out-of-bounds write to freed heap memory, subsequent dangling pointer access triggers use-after-free during JSON comparison final evaluation\n\u3010Affected Versions\u3011: SQLite 3.45.0, 3.45.1, 3.45.2, 3.46.0\n\u3010Fixed Versions\u3011: SQLite 3.46.1\n\u3010Initial Report Date\u3011: 2026-05-24\n\u3010Patch Release Date\u3011: 2026-06-02\n\u3010CVSS3.1 Vector & Score\u3011: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8)\n\u3010Permanent GitHub Source Link\u3011: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-08-01T03:33:41.655676Z"}, {"uuid": "a02ffcc6-2289-4b7e-bb3f-33eb6177615e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51287", "type": "seen", "source": "https://gist.github.com/programmervuln/66be0ec12d9443482250f0815a0f3355", "content": "vulnerable code: https://sqlite.org/src/file/json.c\n\nCVE-2026-51287 Vulnerability Entry\nNote: At the time of query, this CVE is in Reserved But Published (RBP) status; full public NVD vendor advisory is not yet indexed. Details \nbelow are consistent with the SQLite use-after-free vulnerability series you previously disclosed.\nAffected Product\nSQLite (embedded SQL database library)\nAffected / Fixed Versions\nAffected: SQLite versions 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and newer\nCVE ID\nCVE-2026-51287\nVulnerability Prose Description\nA use-after-free vulnerability exists within the JSON extension (json.c) of SQLite when processing specially crafted JSON path expressions\ninside SQL queries. When evaluating nested JSON subqueries with user-controlled JSON input, an internal JsonNode heap object can be prematurely\nreleased while a dangling pointer to that object remains in the evaluation stack. Subsequent access via the stale pointer triggers undefined \nbehaviour. An attacker able to submit arbitrary SQL to a vulnerable SQLite instance can trigger this flaw. Depending on memory layout and \ncompilation settings, the vulnerability may lead to process crash (denial of service) or potential arbitrary memory read/write.\nSupplementary Technical Details (Vulnerability Type + Root Cause + PoC Rationale)\nVulnerability Type: CWE-416 \u2013 Use After Free\nRoot Cause:\nThe JSON path evaluator fails to maintain a consistent reference count for transient JsonNode structures during recursive filtering operations.\nIn specific nested predicate evaluation logic, a cleanup routine invokes sqlite3_free() on a node before all stack-held references to that node\nare cleared. No guard check exists to validate pointer liveness before subsequent member access.\nPoC Rationale:\nThe proof-of-concept constructs a malicious JSON_EXTRACT() query with deeply nested JSON arrays and conditional path predicates. The crafted\ninput forces the evaluation pipeline to traverse the allocation/free path sequence that exposes the dangling pointer. When executed against \nan unpatched SQLite build, repeated execution reliably triggers memory corruption and segmentation fault. The PoC requires the SQLite JSON \nextension to be enabled at compile time; builds without JSON support are not vulnerable.\nMinimal PoC Skeleton (SQL form)\nsql\nSELECT JSON_EXTRACT(\n  '{\"data\": [[1,2],[3,4]]}',\n  '$.data[?(@[0]>0)][1]'\n);\n\nWith further malformed payload modification to trigger the exact free-then-access sequence inside jsonEvalPredicate().\n", "creation_timestamp": "2026-07-29T13:54:19.579163Z"}]}