# CVE-2026-51290: SQLite memory corruption in btree module

Source: https://junglewise.ai/threats/cve-2026-51290-sqlite-memory-corruption-in-btree-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-51290 · Severity: info · CVSS 7.5 · Published 2026-07-30

SQLite, a widely used database engine, contains a memory handling flaw when processing specially crafted database files. If an application using the vulnerable version of SQLite opens a malicious database file, it could lead to a program crash or the unintended exposure of sensitive information from the computer's memory. This could disrupt operations or leak data if users are tricked into opening untrusted files.

## Quick answers

**Is CVE-2026-51290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51290 being exploited in the wild.

**How severe is CVE-2026-51290?** Informational severity, with a CVSS score of 7.5, published 30 July 2026.

**Which products and versions are affected?** SQLite Consortium SQLite 3.41.0.

**Is there a fix for CVE-2026-51290?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51290 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-51290?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory corruption vulnerability exists in the btree.c module of SQLite 3.41.0. The vulnerability stems from two related issues: a use-after-free in the shared cache lock management where a BtLock structure is freed without being removed from a linked list, and insufficient boundary checking for B-tree page offset values. An attacker can exploit this by providing a specially crafted .db file. When the library parses this file, it performs invalid memory read/write operations during page traversal. This can result in a denial of service (application crash) or sensitive memory information disclosure. As of the advisory date, a fix is pending.

## Affected products

- SQLite Consortium SQLite 3.41.0

## Timeline

- 2026-07-30: disclosed
- 2026-07-30: advisory

## References

- [https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51290md](https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51290md)
- [https://github.com/sqlite/sqlite/blob/master/src/btree.c](https://github.com/sqlite/sqlite/blob/master/src/btree.c)