{"id":"CVE-2024-0232","title":"A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c","summary":"A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentia…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-416"],"vendor":"sqlite","product":"sqlite","affected":["sqlite >= 3.43.0, < 3.43.2","enterprise_linux = 8.0","enterprise_linux = 9.0","extra_packages_for_enterprise_linux = 8.0","fedora = 39"],"patched":["sqlite 3.43.2"],"published":"2024-01-16","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:17:17.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-0232","references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-0232","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243754","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2024-0232","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243754","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240315-0007/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-000297.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-277137.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-915275.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00381,"epssPercentile":0.30391,"ingestedAt":"2026-10-15T03:30:12.634Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-07-13T20:18:59.193130Z"},"slug":"CVE-2024-0232","body":"## Overview\n\nA heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.\n\n## Affected\n\n- `sqlite >= 3.43.0, < 3.43.2`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `extra_packages_for_enterprise_linux = 8.0`\n- `fedora = 39`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `sqlite 3.43.2`","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}