Executive brief
SQLite, a widely used database engine, contains a flaw in how it handles JSON data. An attacker can provide a specially crafted, malformed JSON string that causes the database to crash or potentially leak small amounts of memory. This could lead to a service outage for any application using this version of SQLite to process user-supplied JSON.
Technical details
A use-after-free vulnerability exists in SQLite 3.41 within the JSON parsing module. When processing malformed or truncated JSON payloads via SQL JSON functions, the library invokes jsonParseFree() to deallocate a JsonParse structure but fails to nullify the pointer. Subsequent logic attempts to read the 'oom' status flag from this dangling pointer. A remote attacker capable of executing SQL queries with controlled JSON inputs can trigger this flaw to cause a segmentation fault (Denial of Service) or read sensitive data from freed heap memory (Information Disclosure). No official patch was available at the time of disclosure.
Affected products
- SQLite SQLite 3.41
Timeline
- 2026-07-27: disclosed: Initial disclosure of CVE-2026-51298