CVE-2026-51290 describes a use-after-free vulnerability in SQLite 3.41's btree module related to shared cache lock management. Specifically, the program frees a BtLock structure but fails to remove the corresponding node from the linked list, resulting in accesses to released memory during linked list traversal. This memory corruption can cause application crashes (denial of service) and potentially leak sensitive memory contents.

Exploitation of this vulnerability can cause denial of service by crashing applications using the affected SQLite version. Additionally, it may expose sensitive memory information, which could aid attackers in further attacks or data leakage. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.