Executive brief
SQLite, a widely used database engine embedded in countless applications, contains a memory management flaw in its JSON processing module. An attacker could exploit this by providing specially crafted JSON data to an application, potentially causing the application to crash or allowing unauthorized access to sensitive information in the system's memory. This affects any software using SQLite version 3.41 that processes JSON input from external sources.
Technical details
A heap use-after-free (CWE-416) exists in SQLite 3.41 within the jsonCacheInsert() function in src/json.c. The vulnerability is triggered during JSON cache eviction when the cache reaches its maximum capacity of four entries. The function calls jsonParseFree() to deallocate the oldest entry but subsequently executes a memmove() operation that references the now-freed pointer. An attacker can trigger this by supplying multiple large or malformed JSON payloads via SQL functions like json_extract or json_set. This can result in a denial of service (segmentation fault), information disclosure via out-of-bounds reads, or potentially arbitrary code execution. The issue is resolved in SQLite version 3.41.1.
Affected products
- SQLite SQLite 3.41
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory
- 2026-07-30: patched: Fixed in version 3.41.1