Executive brief
A memory management vulnerability was found in SQLite, a widely used database engine found in nearly all operating systems and many applications. An attacker can use specially crafted database queries to cause the application to crash or potentially leak sensitive information. In some cases, this could allow an attacker to gain unauthorized control over the system running the database.
Technical details
A use-after-free (UAF) vulnerability exists in the ExprListDelete() function within SQLite's expression parser (expr.c). The root cause is a failure to clear back-references in parent expression structures when child Expr nodes are released during query transformation or subexpression pruning. An attacker capable of executing arbitrary SQL can trigger this by providing nested queries, window functions, or compound SELECT clauses that force the rewriter to access dangling pointers. This can lead to a process crash (SIGSEGV), heap memory disclosure, or arbitrary code execution if the heap layout is successfully manipulated. The issue is fixed in SQLite version 3.51.3.
Affected products
- SQLite SQLite <= 3.51.2
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory