sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete(), then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid memory read operations. By constructing a malicious SQL statement containing an ORDER BY clause with a large number of items, a remote adversary can trigger this vulnerability. Successful exploitation can result in application crash (denial of service), leakage of sensitive memory contents, and under certain memory layout conditions, arbitrary code execution on the affected system.

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CISA-ADP: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA-ADP: CWE-416

OR
          *cpe:2.3:a:sqlite:sqlite:3.41.0:*:*:*:*:*:*:*

MITRE: https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51304

MITRE: https://github.com/sqlite/sqlite/blob/master/src/expr.c

MITRE: https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51304 Types: Third Party Advisory

MITRE: https://github.com/sqlite/sqlite/blob/master/src/expr.c Types: Product

[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]

{"timestamp":"2026-07-27T17:40:52.205266Z","id":"CVE-2026-51304","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

OR
          *cpe:2.3:a:sqlite:sqlite:3.41.0:*:*:*:*:*:*:*

MITRE: https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51304 Types: Third Party Advisory

MITRE: https://github.com/sqlite/sqlite/blob/master/src/expr.c Types: Product

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416

{"timestamp":"2026-07-27T17:40:52.205266Z","id":"CVE-2026-51304","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete(), then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid memory read operations. By constructing a malicious SQL statement containing an ORDER BY clause with a large number of items, a remote adversary can trigger this vulnerability. Successful exploitation can result in application crash (denial of service), leakage of sensitive memory contents, and under certain memory layout conditions, arbitrary code execution on the affected system.

https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51304

https://github.com/sqlite/sqlite/blob/master/src/expr.c

[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]