SQLite before version 3.54.0 contains a use‑after‑free flaw in its R‑Tree extension. When a database is crafted with a %_node table that has no ROWID or a RAISE(IGNORE) trigger, the nodeWrite() routine hashes nodes to zero and later tries to access freed heap memory. This results in a program crash after a node split and can lead to denial of service or memory‑corruption conditions.

SQLite for all platforms, specifically the SQLite 3.x engine. Versions earlier than 3.54.0 are affected; upgrades to version 3.54.0 or later eliminate the flaw.

The CVSS score is 6.8, giving the flaw moderate severity. EPSS is unavailable and the issue is not in the CISA KEV catalog, which suggests no active exploitation is known. However, the use‑after‑free weakness could still be abused if an attacker can supply a malicious database file that an application loads. Because the vulnerability is triggered through database manipulation, the attack vector most likely requires local or application‑controlled data input; remote exploitation would need opportunity to influence the database. The risk is therefore moderate but significant for applications that load untrusted databases.