The vulnerability stems from incorrect lifetime bounds on closure parameters in multiple callback registration functions. The RustSec advisory explicitly lists these 7 functions across hooks, functions, and collation features. The GitHub issue #1048 provides a concrete reproduction using update_hook, while CVE description specifically calls out rollback_hook. All listed functions share the same pattern of accepting closures that could outlive their captured environments due to insufficient lifetime constraints, enabling use-after-free scenarios when SQLite later invokes these callbacks.