CVE-2026-51302
Received Received - Intake

Use-After-Free in SQLite Database Engine

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: MITRE

Description
SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, and the subsequent exprComputeOperands function continues to access the already freed register memory. By supplying a malicious SQL statement, a remote attacker can exploit this flaw to cause denial of service, leak sensitive information, or potentially execute arbitrary code on the affected system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-51302
EUVD
EUVD-2026-49355

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sqlite sqlite 3.41
sqlite sqlite From 3.41 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-51302 is a use-after-free vulnerability in SQLite version 3.41. It occurs when the sqlite3ReleaseTempReg function frees temporary register memory but does not clear the register identifier, leaving it as a dangling pointer. Later, when exprComputeOperands reuses this identifier, it accesses freed memory, potentially causing crashes, information leaks, or arbitrary code execution.

Detection Guidance

To detect this vulnerability, compile SQLite with AddressSanitizer using the flag -fsanitize=address. Then run the provided Proof of Concept SQL payload in the sqlite3 CLI: SELECT CASE WHEN (1+3) THEN (5*8) ELSE (2/0) END FROM test;. If the system is vulnerable, it will output a heap-use-after-free crash trace.

Impact Analysis

If exploited, this vulnerability can lead to denial of service, sensitive information disclosure by reading freed memory, or arbitrary code execution. Attackers need SQL execution permissions to trigger it, often via malicious SQL statements like complex CASE expressions.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data through memory leaks or arbitrary code execution. Exploitation may lead to data breaches, violating confidentiality requirements under these regulations.

Mitigation Strategies

No official patch has been released as of the advisory date. Immediate mitigation involves restricting SQL execution permissions to trusted users only and avoiding complex CASE expressions that could trigger the vulnerability. Monitor SQLite updates for an official patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart