Executive brief
SQLite, a widely used database engine, contains a memory handling flaw in its JSON processing component. An attacker can exploit this by providing a specially crafted database query that causes the application to crash or potentially leak sensitive information from the computer's memory. This could lead to service outages for any application or website that uses the affected version of SQLite to process JSON data.
Technical details
A use-after-free vulnerability exists in SQLite 3.41 within the jsonExtractFunc function in src/json.c. The flaw is caused by a misordered memory cleanup sequence where jsonParseFree() is called to deallocate a JsonParse structure, but the resulting dangling pointer is subsequently passed to jsonTranslateBlobTo() and dereferenced. A remote attacker capable of executing custom SQL queries can trigger this by passing malformed JSON payloads with extremely large array indices to the json_extract() function. This results in a segmentation fault (Denial of Service) or out-of-bounds reads that may leak residual heap data. No official patch version was specified in the advisory, though the issue is identified in the source code.
Affected products
- SQLite SQLite 3.41
Timeline
- 2026-07-30: disclosed: CVE-2026-51295 published