CVE-2026-51300
Received Received - Intake

Use-After-Free in SQLite 3.41

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: MITRE

Description
A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to release an expression object, the program still retains the dangling pointer and subsequently accesses member fields of the already freed memory. By constructing malicious SQL queries, a remote attacker can trigger invalid memory access, leading to application crash and sensitive memory information leakage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-51300
EUVD
EUVD-2026-49354

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sqlite sqlite 3.41
sqlite sqlite to 3.41 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in SQLite version 3.41. It occurs when the sqlite3ExprDelete function frees an expression object but does not clear a dangling pointer. The program later accesses this freed memory, causing memory corruption. Attackers can exploit this by submitting specially crafted SQL queries to trigger crashes or leak sensitive memory contents.

Detection Guidance

To detect this vulnerability, compile SQLite 3.41 with AddressSanitizer and run crafted SQL queries in the sqlite3 CLI. The tool will output a heap-use-after-free read trace if the issue is triggered.

Impact Analysis

This vulnerability can cause application crashes, leading to denial of service. It may also expose sensitive heap memory contents, resulting in information disclosure. Attackers could leverage this to read unauthorized data or disrupt services relying on SQLite 3.41.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. Organizations using affected SQLite versions may face compliance violations and potential penalties.

Mitigation Strategies

Upgrade SQLite to a patched version once available, as no official vendor patch exists at disclosure. Avoid using SQLite 3.41 and review applications for SQL query inputs that could trigger expression parsing flaws.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51300. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart