SQLite version 3.41 contains a use‑after‑free flaw in the jsonRemoveFunc function of its JSON module. When the parsed JSON object is freed at one line, a subsequent call still accesses the released memory through jsonLookupStep. This bug can be triggered by remote input and leads to a service crash as well as exposure of heap memory contents, providing attackers with sensitive information. The weakness is a classic use‑after‑free vulnerability, as defined in CWE‑416, which contaminates the integrity of the application state and can aid further exploitation. Due to the nature of the flaw, the impact is confined to the process running the SQLite engine and does not affect the host or other processes directly.

SQLite 3.41 is explicitly affected by this use‑after‑free in the JSON module. No other versions or vendor listings are provided. Users running SQLite 3.41 or earlier, or applications that load SQLite 3.41 without patching, are at risk.

The vulnerability is remote‑accessible through crafted JSON input; an attacker can induce the crash or leak memory by sending a specially crafted request to any process that loads SQLite 3.41. The impact is high due to the potential for denial of service and information leakage. No EPSS score is available, so the exact exploitation probability is unknown, but the nature of the flaw suggests it is likely simple to trigger with appropriate input. The flaw is not listed in CISA KEV, yet its severity warrants immediate attention. There is no official patch listed, so the risk remains until the affected code is updated or mitigated.