sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object v…

SQLite version 3.41 contains a use-after-free (UAF) vulnerability in its ORDER BY clause parsing routine. The flaw arises when the code frees an ExprList object via sqlite3ExprListDelete() but subsequently attempts to access the nExpr member of the already-freed object, resulting in a dangling pointer. An attacker can exploit this vulnerability remotely by crafting a malicious SQL statement with an ORDER BY clause containing a large number of items. Successful exploitation can lead to application crashes (denial of service), leakage of sensitive memory contents, and potentially arbitrary code execution depending on memory layout conditions. The vulnerability is tracked as CVE-2026-51304 and is sourced from NVD. The affected code resides in the expr.c source file of the SQLite repository.