Skip to main content

SQLite CVE-2026-51302

| EUVDEUVD-2026-49355 HIGH
Use After Free (CWE-416)
2026-07-27 mitre GHSA-vrg3-8p22-cwh8
RCE Denial Of Service Use After Free Memory Corruption Red Hat N A Suse
7.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Reaching the flaw needs query-submission privilege (PR:L) and reliable exploitation needs heap grooming (AC:H); a UAF can yield memory disclosure, corruption, and crash, so C/I/A High.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

8
Analysis Updated
Jul 30, 2026 - 20:46 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 20:37 vuln.today
cvss_changed
Severity Changed
Jul 30, 2026 - 20:37 NVD
CRITICAL HIGH
CVSS changed
Jul 30, 2026 - 20:37 NVD
9.8 (CRITICAL) 7.5 (HIGH)
Analysis Generated
Jul 28, 2026 - 14:38 vuln.today
CVSS changed
Jul 28, 2026 - 14:37 NVD
9.8 (CRITICAL)
CVE Published
Jul 27, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 00:00 cve.org
CRITICAL 9.8

DescriptionCVE.org

SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, and the subsequent exprComputeOperands function continues to access the already freed register memory. By supplying a malicious SQL statement, a remote attacker can exploit this flaw to cause denial of service, leak sensitive information, or potentially execute arbitrary code on the affected system.

AnalysisAI

Use-after-free in SQLite 3.41's expression-evaluation path lets an attacker who can submit a crafted SQL statement crash the process, leak adjacent memory, or potentially achieve code execution. The flaw stems from sqlite3ReleaseTempReg() prematurely freeing a temporary register that exprComputeOperands() then dereferences. Rated CVSS 7.5 (AV:N/AC:H/PR:L); publicly available exploit code exists per the CISA SSVC 'poc' determination, but it is not on the CISA KEV list and EPSS is low (0.24%, 16th percentile), indicating no evidence of widespread active exploitation.

Technical ContextAI

SQLite is an embedded, in-process relational database engine compiled directly into countless applications, operating systems, browsers, and mobile apps rather than run as a network server. This issue is a CWE-416 Use-After-Free in the query compiler / VDBE code-generation layer (src/expr.c). During expression evaluation SQLite allocates transient VDBE registers to hold intermediate operand values; sqlite3ReleaseTempReg() returns such a register to the free pool, but exprComputeOperands() continues to reference the register slot after it has been released and possibly reallocated, so operand computation reads or writes freed or aliased register memory. Because the corruption occurs inside the engine that processes any submitted SQL, the attack surface is any code path that lets an adversary influence the SQL text or expression structure passed to SQLite 3.41.

RemediationAI

No vendor-released patch identified at time of analysis: the references cite the SQLite source file on the master branch and a third-party advisory repository rather than a tagged fixed release, and no exact fix version was provided, so upgrade to a specific patched build cannot yet be recommended by number; monitor sqlite.org and the official changelog for a release superseding 3.41 and apply it once published. Until a verified fixed version exists, reduce exposure by preventing attackers from supplying arbitrary SQL or expression structures to the engine: enforce strict parameterized queries and eliminate SQL-injection sinks so untrusted input cannot shape the SQL text, restrict which accounts may execute ad-hoc queries, and where feasible run SQLite behind an authorization callback (sqlite3_set_authorizer) or in an isolated/sandboxed process so a UAF crash or memory disclosure is contained. Trade-offs: an authorizer and query allowlisting can break applications that rely on dynamic SQL, and process isolation adds latency and complexity but limits blast radius. Track the fix via the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-51302) and the upstream src/expr.c history.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

CVE-2026-51302 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy