The flaw is a use‑after‑free in fts3BestSnippet() triggered by a full‑text MATCH query that combines OR and NEAR operators with snippet(). When SQLite is built with FTS3/FTS4 and the optional SQLITE_ENABLE_FTS3_PARENTHESIS flag, the cached position‑list pointers can become dangling. An attacker that can execute a MATCH query can read memory that has already been freed and cause the process to crash. This can expose data that was on the heap and lead to a denial of service. The weakness is classified as CWE‑416.

The issue is limited to SQLite libraries before version 3.54.0 that are configured with full‑text search (FTS3/FTS4) and enable the SQLITE_ENABLE_FTS3_PARENTHESIS option. The affected product is SQLite, any distribution or embedded system that links against a pre‑3.54.0 build. No specific operating systems are listed, so all platforms that use this older SQLite are potentially vulnerable.

The CVSS score of 6.8 indicates medium risk. The EPSS score is not available, so the current probability of exploitation is unknown, but the lack of a KEV listing suggests no active exploitation in the wild as of today. The vulnerability requires the ability to issue a MATCH query that uses snippet() with OR and NEAR operators, so it is exploitable by adversaries that can run queries against the database. If successful, they can read freed heap memory or crash the database process.