Executive brief
SQLite, a widely used database engine, contains a flaw in how it handles temporary data during complex calculations. An attacker who can run database queries could use this to crash the application, access sensitive information in memory, or potentially take control of the system. This affects any software that uses the vulnerable version of SQLite to process untrusted SQL commands.
Technical details
A use-after-free vulnerability exists in SQLite 3.41 within the expression evaluation logic in 'expr.c'. The 'sqlite3ReleaseTempReg' function improperly releases temporary register resources without clearing the associated register identifier, creating a dangling pointer. Subsequent calls to 'exprComputeOperands' continue to access this freed memory. An attacker with SQL execution privileges can trigger this by providing a malicious SQL statement containing complex multi-layer compound expressions (such as nested CASE statements). This can result in a process crash, leakage of heap memory, or arbitrary code execution via heap spraying. No official patch was available at the time of the advisory.
Affected products
- SQLite SQLite 3.41
Timeline
- 2026-07-27: disclosed: Vulnerability disclosed via NVD and GitHub advisory.