SQLite 3.41 has a use-after-free vulnerability in the shared cache lock management logic of the btree module. The program frees a BtLock structure without remov…

SQLite version 3.41 contains a use-after-free vulnerability within the shared cache lock management logic of its btree module. The flaw occurs when a BtLock structure is freed without first removing the corresponding node from the linked list. Subsequent traversal of the linked list then accesses the already-released memory region. This memory mismanagement can be exploited to cause denial of service (DoS) conditions. Additionally, the vulnerability may lead to sensitive memory information disclosure. The issue resides specifically in the btree.c source file of the SQLite codebase. The vulnerability has been assigned CVE-2026-51290 and is currently awaiting full analysis by NVD. Its criticality is rated High due to the potential for both service disruption and data leakage.