CVE-2026-51300
A use‑after‑free flaw in SQLite 3.41 lets a remote attacker craft SQL queries that cause the program to access memory that has already been freed. This can crash the application and expose sensitive data from memory. The issue is serious enough to receive a CVSS score of 9.1.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
SQLite 3.41, used by many applications that embed the database engine.
Real-world impact
An attacker could cause the target application to crash and potentially read confidential information from memory, which could be used for further attacks.
Why this severity
The CVSS score of 9.1 reflects the vulnerability’s high impact: it requires no user interaction, no privileges, and can lead to complete loss of confidentiality and availability. The attack is straightforward over the network and can be executed remotely.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources