(Edited to correct hazard preconditions and reflect fix status.) This is, technically, a race as claimed. The only potential harm would be when:<br> Multiple threads initially request the temp directory name at (nearly) the same time in the same process;<br> For different connections;<br> On a build with 64-bit pointers;<br> Running on a 32-bit machine.<br> This is extremely unlikely to ever happen, of course. Nevertheless, a ["cure" has been checked into the source](https://sqlite.org/src/info/95806ac1dabe4598) (thanks to Dan.)