CVE-2026-51303
SQLite 3.41 contains a memory error that lets attackers send specially crafted SQL commands to crash the program or, in some cases, run code. The flaw is a use‑after‑free bug in the core parsing component. It can cause denial of service or data leaks.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
SQLite 3.41, the database engine used by many desktop, mobile, and embedded applications.
Real-world impact
An attacker can crash the application, expose sensitive memory contents, or potentially execute arbitrary code on the affected host.
Why this severity
The CVSS score of 9.8 reflects that the flaw is remotely exploitable with no authentication or user interaction, and it can lead to complete compromise, denial of service, or data leakage.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources