CVE-2026-51302

SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, and the subsequent exprComputeOperands function continues to access the already freed register memory. By supplying a malicious SQL statement, a remote attacker can exploit this flaw to cause denial of service, leak sensitive information, or potentially execute arbitrary code on the affected system.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/51xxx/CVE-2026-51302.json"
}

References

Affected packages

Git / github.com/sqlite/sqlite

Affected ranges

Type

GIT

Repo

https://github.com/sqlite/sqlite

Events

Introduced

3b832a1a29a6f1ffa3030c5dc1f734919f1bebd4

Last affected

3b832a1a29a6f1ffa3030c5dc1f734919f1bebd4

Database specific

Show details

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:sqlite:sqlite:3.41.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.41.0"
        },
        {
            "last_affected": "3.41.0"
        }
    ]
}

Affected versions

3.*

3.41.0

version-3.*

version-3.41.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-51302.json"