CVE-2026-51303
Received Received - Intake

Use-After-Free in SQLite Core Parsing Component

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: MITRE

Description
A use-after-free (UAF) vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprList object via sqlite3ExprListDelete and then subsequently accesses the dangling pointer of the released object. A remote adversary can supply specially crafted SQL queries to trigger this vulnerability during SQL statement parsing. Successful exploitation may result in application crash (denial of service), sensitive memory information leakage, and in some scenarios, arbitrary code execution on the affected host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-51303
EUVD
EUVD-2026-49356

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sqlite sqlite 3.41
sqlite sqlite to 3.51.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in SQLite 3.41 where an ExprList object is freed via sqlite3ExprListDelete but its pointer is later accessed again. Attackers can exploit this by sending specially crafted SQL queries during parsing, leading to memory corruption, crashes, or potential code execution.

Detection Guidance

Detecting this vulnerability requires checking the SQLite version in use. Run 'sqlite3 --version' to verify if your system uses SQLite 3.51.2 or earlier. If so, the system is vulnerable. Additionally, monitor for application crashes during SQL parsing, especially with complex queries involving nested expressions or window functions.

Impact Analysis

The vulnerability may cause application crashes (denial of service), leak sensitive memory information, or allow arbitrary code execution if exploited. It specifically targets SQLite's parsing of complex SQL statements with nested expressions or window functions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory corruption that may lead to unauthorized access or leakage of sensitive data. Exploitation might allow attackers to read or manipulate memory, which could expose personal or health information, violating confidentiality requirements under these regulations.

Mitigation Strategies

Immediately upgrade SQLite to version 3.51.3 or later to patch the use-after-free flaw. If upgrading is not immediately possible, restrict access to applications using SQLite to trusted users only and avoid executing complex or untrusted SQL queries until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart