CVE-2026-119378
Sqlite: use-after-free can lead to denial of service
- Risk score
- 41/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0,…
- Affected
- Sqlite before 3.54.0
- Fix
- Upgrade Sqlite to 3.54.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
Sqlite: Amber, patch this week. SQLite command-line shell has a command injection vulnerability in the .recover command, allowing attackers to execute OS commands when victims pipe .recover output into sqlite3.
The flaws
- CVE-2026-119378: Use-after-free can lead to denial of service (CVSS 5.5 · EPSS 0%)
- CVE-2026-119586: Command injection (CVSS 7.8 · EPSS 2%)
- CVE-2026-119379: Out-of-bounds write (CVSS 7.8 · EPSS 0%)
- CVE-2026-119374: Out-of-bounds write can lead to denial of service (CVSS 7.8 · EPSS 0%)
The fix
Upgrade Sqlite: 3.54.0 or later on your release line
Who is exposed: {'product': 'sqlite', 'package': [], 'version': 'through 3.54.1'}
Where it stands
- Public proof of concept
Connects to
- Same weakness: Use-after-free (CWE-416). 400 other warnings in 30 days
- Same product: Earlier Sqlite warnings. 7 in the last 90 days
Why it is Yellow
- CVSS 5.5 medium
- Public exploit or proof of concept referenced
References
- https://abraxaslabs.tech/research/sqlite-rtree-rowid0
- https://github.com/sqlite/sqlite
- https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905
- https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04
- https://sqlite.org/releaselog/3_54_0.html
- https://sqlite.org/src/info/6a9e1415659f9e75
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite
Original description
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
Last activity 30 Oct 2026. Patch Forecast updates every hour.