SQLite, Thrift, and cJSON Vulnerabilities Disclosed
SQLite, Apache Thrift, and cJSON face critical vulnerabilities including use-after-free, denial-of-service, and remote code execution.
A use-after-free vulnerability in SQLite (CVE-2026-51300) can lead to application crashes and information leakage. This flaw arises from improper handling of memory after it has been freed, potentially allowing attackers to exploit dangling pointers to access sensitive data or disrupt service. The risk is rated high due to the potential for both denial-of-service and information disclosure.
Apache Thrift, a widely used RPC framework, is affected by two denial-of-service vulnerabilities. CVE-2026-55969 stems from an integer overflow or wraparound when processing data, while CVE-2026-48586 is due to the improper handling of highly compressed data. Both flaws can be triggered remotely, allowing an attacker to crash services that rely on Apache Thrift, impacting availability for dependent applications.
A critical vulnerability in the cJSON library (CVE-2026-16554) allows for remote code execution due to an integer overflow when parsing crafted JSON data. This flaw, rated as moderate severity, could enable attackers to compromise systems by tricking applications into processing malicious JSON payloads. The widespread use of cJSON in various applications makes this a significant concern for developers and users alike.
GNU Binutils, a collection of programming tools for the GNU operating system, contains a heap-based buffer overflow in its linker (CVE-2026-15003). This vulnerability can lead to information disclosure and denial of service. Attackers can exploit this by providing specially crafted input to the linker, potentially revealing sensitive memory contents or causing the tool to crash.
Two heap-based buffer over-read vulnerabilities were discovered in the ncurses library's terminfo component (CVE-2019-17595 and CVE-2019-17594). These flaws, present in versions before 6.1-20191012, could allow an attacker to crash applications that use ncurses or potentially leak information from the heap. The terminfo library is crucial for terminal handling, making these vulnerabilities relevant to a broad range of Unix-like systems.