Embedded SQLite Apps Inherit a Critical Memory Bug
Any application that ships its own SQLite build can inherit this flaw, even if it is not a database server. The bug sits in expression evaluation, so crafted SQL can turn normal query handling into a crash, data leak, or code execution inside the app.
NCSC-NL says SQLite 3.41 has a use-after-free in expression evaluation, tracked as CVE-2026-51302 and rated CVSS 10.0. It affects systems using SQLite, including downstream Red Hat products, and the consortium has released updates.
The real exposure is in software that accepts SQL-like input or embeds SQLite as a library. Patching the database layer alone is not enough if a bundled build is still shipped inside the application.