Bug 2507546 (CVE-2026-51296) - CVE-2026-51296 sqlite: SQLite: Use-after-free vulnerability leads to denial of service and information disclosure
Summary: CVE-2026-51296 sqlite: SQLite: Use-after-free vulnerability leads to denial o...
Keywords:
Status: NEW
Alias: CVE-2026-51296
Product: Security Response
Classification: Other
Component: vulnerability-draft
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2507910 2507911 2507912 2507913 2507914 2507915 2507916 2507909
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-27 16:01 UTC by OSIDB Bzimport
Modified: 2026-08-04 10:22 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-27 16:01:32 UTC 
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.
Note You need to log in before you can comment on or make changes to this bug.