SQLite 3.41 UAF in jsonRemoveFunc (CVE-2026-51296): POC and Analysis

Vulnerability Overview Vulnerability Name: CVE-2026-51296 Vulnerability Type: Use After Free (UAF) Affected Product: SQLite Affected Version: SQLite 3.41 Vulnerability Description: A use-after-free vulnerability exists in the function within the JSON processing module of SQLite 3.41. When maliciously crafted JSON input is passed to the SQL built-in function, the code path frees the allocated JSON parsing object pointer while retaining a dangling pointer. Subsequent calls to access internal JSON structure data using this freed pointer, resulting in a persistent use-after-free vulnerability. Remote attackers can leverage this vulnerability to execute arbitrary SQL queries, creating malicious JSON payloads and invalid JSON path parameters to reliably trigger the issue. Successful exploitation leads to program crashes (Denial of Service) and the leakage of uninitialized or residual heap memory contents; under specific heap memory layout conditions, arbitrary code execution may be achieved. Impact Scope Primary Impact: Denial of Service (persistent SQLite process crash) Secondary Impact: Sensitive heap memory information disclosure (leakage of previous runtime data from heap allocations) Edge Case Risk: Arbitrary code execution by controlling heap spraying and memory corruption primitives Attack Vector: Remote, does not require local file/directory access permissions; only requires the ability to run SQLite queries within custom SQL statements Remediation Fix Status: As of the vulnerability report, no official fixed version is available. Remediation Advice: It is recommended that users upgrade to a version of SQLite that includes the fix, or implement other mitigation measures such as restricting access to SQLite and avoiding the execution of untrusted SQL queries. POC Code Exploitation Details Vulnerability Trigger Condition: When receives malicious JSON and invalid path inputs, the parser hits an early error branch at line 3555 of . Exploitation Steps: 1. Input Selection Logic: Two attacker-controllable inputs determine whether the unsafe code path is executed. 2. Malicious Top-Level JSON Payload: Provide an incomplete JSON object (triggering early parsing failure to hit the cleanup branch). 3. Invalid Deep JSON Path String: Use a multi-segment path that cannot be parsed from the malicious JSON, forcing a lookup call to be hit after cleanup. 4. Reproducibility and Sanitizer Verification: Compile SQLite 3.41 with AddressSanitizer to detect heap allocation/release operations. 5. Execute Malicious Query: Run the malicious query in the SQLite CLI shell. 6. ASAN Output: ASAN outputs clear heap use-after-free error logs, marking the exact location in where freed memory is accessed. 7. Crash Log Analysis: Crash logs prove that dangling pointer dereference is deterministic, confirming the vulnerability is exploitable rather than being a theoretical code path. 8. Exploitation Impact (POC Security Significance): Denial of Service (DoS): Executing the malicious SQL query immediately causes the SQLite process to crash in standard builds; a remote attacker with SQL execution privileges can repeatedly crash the database service. 9. Information Disclosure: Without ASAN, the dangling pointer read returns arbitrary residual heap data from previous allocations. Attackers can extract sensitive runtime values (other SQL records, credentials cached in heap memory) by freeing memory regions. 10. Arbitrary Code Execution Potential: Attackers can combine this UAF with heap spraying primitives (controlling JSON block allocations) to overwrite the structure metadata after but before . Manipulating function pointers allows hijacking of program control flow when dereferences the corrupted structure.

Goal Reached Thanks to every supporter — we hit 100%!

SQLite 3.41 UAF in jsonRemoveFunc (CVE-2026-51296): POC and Analysis

More from this source