A use‑after‑free vulnerability in SQLite 3.41 causes the engine to free an expression object but later continue to use the dangling pointer. When a maliciously crafted query is parsed, the engine accesses fields of the freed memory, resulting in a crash and the accidental disclosure of sensitive data that resided in that memory region. This flaw directly compromises the stability of the application and can expose confidential information that the process held in memory at the time of the access.

SQLite 3.41 is affected. The flaw exists in the expression parsing and memory‑management logic as implemented in the sqlite3ExprDelete function. No vendor name is specified beyond the SQLite project; the vulnerability is present in all builds that include the affected source files.

The likely attack vector is through any endpoint that forwards user-supplied SQL to the SQLite engine, such as web services, embedded systems, or client applications that accept raw queries. The absence of public exploits does not diminish the theoretical risk of abuse; a local or remote attacker capable of submitting a query can trigger the defect.