sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by…

SQLite version 3.41 contains a use-after-free vulnerability in its JSON parsing logic. Remote adversaries can craft malicious JSON payloads to trigger a memory free operation followed by illegal memory access. Successful exploitation may lead to arbitrary code execution, sensitive information leakage, or denial of service. The vulnerability is remotely exploitable, increasing its severity. It has been assigned CVE-2026-51297 and is tracked by NVD. A proof-of-concept advisory has been published on GitHub. The affected source file is identified as json.c in the SQLite repository.