Executive brief
SQLite, a widely used database engine, contains a memory handling flaw in its JSON processing component. An attacker with the ability to run database queries can use specially crafted JSON data to crash the application or potentially view sensitive information stored in memory. This could lead to service outages or unauthorized data exposure for any application using the affected version of SQLite.
Technical details
A use-after-free vulnerability exists in SQLite 3.41 within the jsonArrayLengthFunc function located in src/json.c. The root cause is improper memory lifecycle management where the jsonParseFree(p) function deallocates the JsonParse structure, but the code subsequently attempts to dereference the dangling pointer 'p' to calculate array lengths. An attacker can trigger this by providing a malformed JSON payload and an invalid JSON path to the json_array_length() SQL function. This results in a heap-based use-after-free read, which reliably causes a denial of service (segmentation fault) and may allow for information disclosure of adjacent heap memory.
Affected products
- SQLite SQLite 3.41
Timeline
- 2026-07-30: disclosed: Vulnerability details published via GitHub and NVD