CVE-2026-51302
SQLite version 3.41 contains a use-after-free flaw in its expression evaluation logic. The sqlite3ReleaseTempReg function incorrectly frees temporary register resources, which are then accessed by exprComputeOperands, allowing a remote attacker to trigger denial of service, information disclosure, or arbitrary code execution via a malicious SQL statement. The vulnerability is rated critical with a CVSS base score of 9.8.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of SQLite 3.41 (no specific product list provided).
Real-world impact
An attacker could crash the application, leak sensitive data, or execute arbitrary code on systems that process untrusted SQL input.
Why this severity
The CVSS score of 9.8 reflects a network‑reachable attack with low complexity, no privileges or user interaction required, and high impacts to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 17h agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/programmervuln/cveadvisory-…third party advisory
- github.com/sqlite/sqlite/blob/master/s…product