The vulnerability is a use‑after‑free in the Ruby bindings for SQLite that occurs when callbacks registered for aggregate functions are freed while still in use during aggregation. The flaw can corrupt memory or cause a crash; the CVE description does not explicitly state that it can lead to code execution, so that possibility is not asserted in this report.

The sparklemotion sqlite3‑ruby gem from version 2.1.0 through 2.9.4 is vulnerable. Any Ruby application that loads this gem and registers custom aggregate functions may be affected. Versions 2.9.5 and later contain the fix.

The CVSS score of 2 indicates low severity and the EPSS <1 % signals a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The vulnerability requires local execution of Ruby code that registers aggregate functions, making the attack vector local or delegated rather than remote. Given the low impact and limited attack surface, monitoring is advisable while applying the available fix.