CVE-2026-51304
CVE Details
Visit the official vulnerability details page for CVE-2026-51304 to learn more.
Initial Publication
07/27/2026
Last Update
07/28/2026
Third Party Dependency
sqlite-libs
NIST CVE Summary
sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete(), then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid memory read operations. By constructing a malicious SQL statement containing an ORDER BY clause with a large number of items, a remote adversary can trigger this vulnerability. Successful exploitation can result in application crash (denial of service), leakage of sensitive memory contents, and under certain memory layout conditions, arbitrary code execution on the affected system.
CVE Severity
Our Official Summary
Investigation is ongoing to determine how this vulnerability affects our products.
Status
Undergoing Analysis
Affected Products & Versions
| Version | PaletteAI | PaletteAI VerteX |
|---|---|---|
| 1.2.0 | ⚠️ Impacted | ⚠️ Impacted |
Revision History
No revisions available.