Executive brief
SQLite, a widely used database engine embedded in countless applications and web services, contains a critical memory handling flaw in its JSON processing component. An attacker can exploit this by sending specially crafted data to an application that uses SQLite to process JSON, potentially leading to a complete system crash, theft of sensitive information from the database, or unauthorized control over the affected system. This vulnerability is particularly serious because it can be triggered remotely without needing any login credentials.
Technical details
A CWE-416 use-after-free vulnerability exists in SQLite 3.41 within the JSON parsing logic of src/json.c. The flaw occurs because the sqlite3RCStrUnref() function deallocates the dynamic zBuf character buffer, but the program immediately follows this with a call to jsonStringZero(p), which dereferences the now-dangling pointer. Remote, unauthenticated attackers can trigger this code path by providing malformed JSON or JSONB payloads to SQL functions such as json_extract, json_array_length, or json_remove. Successful exploitation can result in heap memory corruption, leading to process crashes, disclosure of adjacent heap data, or arbitrary code execution via heap spray techniques. The issue is resolved in SQLite version 3.41.1 and later.
Affected products
- SQLite SQLite 3.41
Timeline
- 2026-07-30: disclosed: Initial CVE publication
- 2026-07-30: advisory: Detailed advisory published by programmervuln on GitHub