CVE Watch27 jul 2026

CVE-2026-51296

SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 27 jul 2026 · Última mod.: 27 jul 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.

Referencias oficiales

github.comhttps://github.com/programmervuln/cveadvisory-/commit/75a435c839a4bcc6ca2ad21e3b07c978d814acb2
github.comhttps://github.com/sqlite/sqlite/blob/master/src/json.c

CVEs relacionados

Sin CVEs relacionados por CWE o producto.