What is the CVSS score of CVE-2026-51291?

CVE-2026-51291 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SQLite are affected by CVE-2026-51291?

SQLite 3.41's JSON extension contains a use-after-free vulnerability (CVSS 9.8) that could result in denial of service or code execution if exploited through untrusted JSON input processed by…

How to fix or mitigate CVE-2026-51291?

Within 24 hours, identify all applications using SQLite 3.41 and determine which expose JSON functions (json1 extension) to untrusted input sources. Within 7 days, implement compensating controls for identified at-risk applications: disable the JSON1 extension if not business-critical, enforce strict JSON schema validation on inputs, and restrict database access to trusted internal systems where feasible. Within 30 days, develop a remediation plan including upgrade timelines for SQLite once a patch is released, and deploy application-level input filtering and process privilege separation to limit blast radius if exploitation occurs.

SQLite CVE-2026-51291

EUVD-2026-51256 CRITICAL

Use After Free (CWE-416)

2026-07-30 mitre

GHSA-9cw3-r74p-wgw5

Denial Of Service Use After Free Memory Corruption N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network vector is inherited only when an app feeds untrusted JSON to SQLite, and reliable UAF exploitation needs heap grooming, so AC:H rather than the published AC:L; impacts kept High given memory-corruption potential.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:40 vuln.today

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

sqlite 3.41 is vulnerable to use after free in the json.c jsonCacheInsert function of the JSON cache management module.

AnalysisAI

Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.

Technical ContextAI

SQLite is a self-contained, serverless relational database engine embedded directly into applications, browsers, mobile OSes, and countless devices; the affected code lives in the JSON extension (src/json.c), specifically the JSON cache management routine jsonCacheInsert used to memoize parsed JSON blobs across function calls within a statement. The flaw is classified CWE-416 (Use After Free), meaning a heap object is referenced after it has been freed - in this case a cached JSON parse structure that is released while a pointer to it is still live, so a subsequent insert/lookup dereferences dangling memory. UAF conditions in a parser cache are commonly reached through crafted or malformed JSON passed to functions such as json(), json_extract(), or json_valid(), and their impact ranges from deterministic crashes to controllable heap corruption depending on allocator state.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed SQLite version, release tag, or fix commit is present in the provided data (the GitHub reference points to the live src/json.c, not a patched release). Monitor the official SQLite changelog at sqlite.org and upgrade to the first release published after this CVE that lists a json.c/jsonCache fix, once confirmed. As specific compensating controls until a fix is verified: avoid passing untrusted or externally-supplied JSON directly into SQLite JSON1 functions (json(), json_extract(), json_valid(), etc.), validate and canonicalize JSON in the application layer before it reaches SQLite, and where feasible compile SQLite without the JSON extension (omit SQLITE_ENABLE_JSON1 / build with -DSQLITE_OMIT_JSON) - the trade-off is loss of all JSON query functionality for applications that rely on it. Corroborate against the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-51291); note the third-party advisory (github.com/programmervuln) is unverified and should not be treated as authoritative.