CVE-2026-51303: Use After Free
A use-after-free (UAF) vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprList object via sqlite3ExprListDelete and then subsequently accesses the dangling pointer of the released object. A remote adversary can supply specially crafted SQL queries to trigger this vulnerability during SQL statement parsing. Successful exploitation may result in application crash (denial of service), sensitive memory information leakage, and in some scenarios, arbitrary code execution on the affected host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLite 3.41 core parsing componentto a version that resolves this vulnerability.Fixed in 3.41
Event History
Frequently Asked Questions
What is the severity of CVE-2026-51303?
CVE-2026-51303 has a critical severity rating of 9.8 on the CVSS scale.
How do I fix CVE-2026-51303?
To fix CVE-2026-51303, update SQLite to version 3.42 or later where the vulnerability is addressed.
What type of vulnerability is CVE-2026-51303?
CVE-2026-51303 is a use-after-free vulnerability that can lead to potential remote code execution.
Who is affected by CVE-2026-51303?
CVE-2026-51303 affects users of SQLite 3.41 and earlier versions that utilize the core parsing component.
How can CVE-2026-51303 be exploited?
An attacker can exploit CVE-2026-51303 by supplying specially crafted input to execute arbitrary code remotely.