A use-after-free (UAF) vulnerability has been identified in the core parsing component of SQLite version 3.41. The vulnerability arises when the program frees an ExprList object via sqlite3ExprListDelete and subsequently accesses the dangling pointer of the freed object. A remote attacker can exploit this flaw by supplying specially crafted SQL queries during SQL statement parsing. Successful exploitation can lead to application crashes (denial of service), sensitive memory information leakage, and potentially arbitrary code execution on the affected host. The vulnerability is tracked as CVE-2026-51303 and has been assigned a high criticality rating. The flaw is rooted in the expr.c source file within the SQLite codebase. Organizations using SQLite 3.41 are advised to apply patches or mitigations promptly given the potential for remote exploitation.