A use‑after‑free flaw exists in SQLite 3.41’s core parsing logic. During statement parsing the engine frees an ExprList object but later accesses the released memory, creating a dangling pointer. An attacker who supplies crafted SQL can trigger the flaw. When successfully exploited the application may crash, leak sensitive memory contents, or, in some cases, execute arbitrary code on the host.

SQLite databases running version 3.41 are affected. The vulnerability targets the parsing component of the SQLite library; no specific vendor or product version list is provided beyond the 3.41 release.

The CVSS score of 9.8 reflects a high‑severity risk. With no EPSS score available and the vulnerability not listed in the CISA KEV catalog, the exact current exploitation probability is unclear, but the high score and the susceptibility to remote SQL inputs confirm that an attacker can trigger the flaw over the network. Successful exploitation can lead to denial of service, information disclosure, and possibly arbitrary code execution.