CVE-2026-51298

MEDIUM

SQLite 3.41 - Use-After-Free in JSON Extraction Function Leading to Denial of Service

Title source: llm
STIX 2.1

Description

sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.

References (2)

Core 2

Scores

CVSS v3 6.2
EPSS 0.0011
EPSS Percentile 1.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-416
Status published
Products (1)
sqlite/sqlite 3.41.0
Published Jul 27, 2026
Tracked Since Jul 27, 2026