When “Critical CVEs” Are Hallucinations: A Practical SQLite Triage Playbook
“Critical” CVEs are often treated as facts, but SQLite’s own guidance highlights that CVE data can be inaccurate. This post turns the investigation into a repeatable workflow: confirm upstream recognition, map versions to source, validate the claimed bug mechanics, and reproduce PoCs under AddressSanitizer to separate real UAF-style issues from hallucinated “slop.”