CVE-2026-51295 identifies a use-after-free vulnerability in SQLite 3.41 within the jsonExtractFunc function. The issue arises when the memory for a parsed JSON object is released prematurely, leading to subsequent illegal access of the freed pointer. Exploitation requires sending specially crafted SQL queries to the affected SQLite instance, which can result in a denial of service (service crash) and leakage of sensitive memory data. No patch or official remediation information is currently available, and there are no known exploits in the wild.

Successful exploitation can cause the SQLite service to crash, resulting in denial of service. Additionally, sensitive memory information may be leaked, which could aid attackers in further attacks or data disclosure. The vulnerability can be triggered remotely via SQL queries, increasing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected SQLite service to trusted users and environments to reduce exposure. Monitor vendor communications for updates on patches or mitigations.