These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A buffer overflow vulnerability exists in SQLite, specifically in the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), and sqlite3_malloc(int) components. This vulnerability, present in affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, [truncated]
A use-after-free vulnerability was discovered in sqlite 3.41's ORDER BY clause parsing routine. The affected code releases the memory of an ExprList object via sqlite3ExprListDelete(), then attempts to access the nExpr member of the already freed object. This can cause application crashes, sensitive memory leakage, and potentially arbitrary code execution. Developers and administrators using sqlite 3.41 s [truncated]
A use-after-free vulnerability was discovered in SQLite 3.41's core parsing component. The flaw occurs because the program frees an ExprList object and then accesses the dangling pointer. A remote adversary can supply specially crafted SQL queries to trigger this vulnerability during SQL statement parsing. This issue affects users of SQLite 3.41, particularly developers integrating SQLite into their appli [truncated]
A use-after-free vulnerability exists in SQLite 3.41's expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, and the subsequent exprComputeOperands function continues to access the already freed register memory. By supplying a malicious SQL statement, a remote attacker can exploit this flaw to cause denial of service, leak sensitive information, [truncated]
A use-after-free vulnerability exists in SQLite 3.41's expression parsing and memory management logic. After invoking sqlite3ExprDelete to release an expression object, the program retains the dangling pointer and accesses already freed memory. Malicious SQL queries can trigger invalid memory access, causing application crashes and sensitive memory information leakage. This vulnerability has a high impact [truncated]
CVE-2026-51298 is a use-after-free vulnerability in sqlite 3.41's JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal members of the freed pointer, which can cause service crashes and denial of service. This vulnerability can impact users of sqlite 3.41, especially those utilizing the JSON extraction function. Affected deployments shou [truncated]
CVE-2026-51297 is a use-after-free vulnerability in sqlite 3.41's JSON parsing logic. Remote adversaries can craft malicious JSON payloads to trigger memory free followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage, and service denial. This vulnerability exists in the JSON parsing logic of sqlite 3.41, and its exploitation could result in memory [truncated]
CVE-2026-51296 is a use-after-free vulnerability in the jsonRemoveFunc of SQLite JSON module in SQLite 3.41. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. This flaw allows remote attackers to crash the service and leak heap memory information. The vulnerability has a high impact on systems using SQLite 3.41, especially in networked or s [truncated]
CVE-2026-11824 is a high-severity vulnerability in SQLite's FTS5 full-text search extension. The vulnerability exists in SQLite versions prior to 3.53.2 and allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata. This metadata specifies a szLeaf value smaller than 4, triggering an integer underflow in fts5ChunkIterate() and lea [truncated]
CVE-2026-11822 is a high-severity vulnerability in SQLite's FTS5 full-text search extension. The vulnerability allows attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. This can be achieved through an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in f [truncated]
A critical vulnerability (CVSS Score: 9.2) was disclosed in SQLite 'sqldiff.exe' on 2026-06-04. The vulnerability occurs because 'sqldiff.exe' does not securely handle the conversion of Unicode characters to ANSI codepages by the Microsoft Windows C runtime. This allows an attacker to use the '-L' option to load an arbitrary DLL with a crafted command line argument string, resulting in command line file a [truncated]