Executive brief
SQLite is a widely used database engine embedded in countless applications, browsers, and operating systems. A memory safety flaw in its JSON processing component allows an attacker to crash applications or potentially execute unauthorized code by sending specially crafted JSON data. This could lead to service outages, theft of sensitive information, or full system compromise depending on how the application uses the database.
Technical details
A use-after-free (CWE-416) vulnerability exists in SQLite 3.41 within the JSON blob processing logic in src/json.c. The flaw occurs because the 'aBlob' member of the Parse structure is deallocated via sqlite3DbFree() but the pointer is not subsequently nulled. A following call to jsonBlobAppendNode() dereferences this dangling pointer, leading to heap memory corruption. An unauthenticated remote attacker can trigger this by providing oversized or malformed JSON/JSONB payloads to SQL functions like json_insert(). This can result in a segmentation fault (DoS), leakage of sensitive heap memory, or arbitrary code execution via heap spraying. The issue is fixed in version 3.41.1.
Affected products
- SQLite SQLite 3.41
Timeline
- 2026-04-28: disclosed: Vulnerability confidentially submitted to maintainers
- 2026-05-02: patched: Fixed in SQLite 3.41.1
- 2026-07-30: advisory: CVE-2026-51293 published