Use-After-Free Vulnerability in SQLite Affected by FTS3 Feature
CVE-2026-119372

6.8MEDIUM

Key Information:

Vendor

Sqlite

Status
Sqlite
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119372?

SQLite prior to version 3.54.0, when built with FTS3 and the SQLITE_ENABLE_FTS3_PARENTHESIS option, is susceptible to a use-after-free vulnerability found in the fts3BestSnippet() function. This issue arises due to dangling position-list pointers that have been freed incorrectly. Perpetrators can exploit this vulnerability by executing a crafted full-text MATCH query using both OR and NEAR operators in combination with the snippet() function, leading to potential access of deallocated heap memory and subsequent crash of the database process.

Affected Version(s)

SQLite All platforms where SQLITE_ENABLE_FTS3 (or SQLITE_ENABLE_FTS4) and SQLITE_ENABLE_FTS3_PARENTHESIS are defined 0 < 3.54.0

References

https://sqlite.org/bugs/info/2026-08-17T09:18:24Z
issue-tracking
https://sqlite.org/src/info/e4635c4153
patch
https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marc Heuse
Abraxas Labs
Dan Kennedy
.