CVE-2026-51304

sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete(), then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid memory read operations. By constructing a malicious SQL statement containing an ORDER BY clause with a large number of items, a remote adversary can trigger this vulnerability. Successful exploitation can result in application crash (denial of service), leakage of sensitive memory contents, and under certain memory layout conditions, arbitrary code execution on the affected system.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/51xxx/CVE-2026-51304.json"
}

References

Affected packages

Git / github.com/sqlite/sqlite

Affected ranges

Type

GIT

Repo

https://github.com/sqlite/sqlite

Events

Introduced

3b832a1a29a6f1ffa3030c5dc1f734919f1bebd4

Last affected

3b832a1a29a6f1ffa3030c5dc1f734919f1bebd4

Database specific

Show details

{
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.41.0"
        },
        {
            "last_affected": "3.41.0"
        }
    ],
    "cpe": "cpe:2.3:a:sqlite:sqlite:3.41.0:*:*:*:*:*:*:*"
}

Affected versions

3.*

3.41.0

version-3.*

version-3.41.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-51304.json"