Use-After-Free Vulnerability in SQLite R-Tree Extension by SQLite
CVE-2026-119378

6.8MEDIUM

Key Information:

Vendor

Sqlite

Status
Sqlite
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119378?

An issue has been identified that affects SQLite prior to version 3.54.0, whereby a use-after-free vulnerability exists within the R-Tree extension. This flaw enables attackers to manipulate the %_node shadow table, potentially forcing applications to operate on freed heap memory. Specifically, attackers can craft a database designed to declare %_node WITHOUT ROWID or implement a RAISE(IGNORE) trigger. This manipulation results in the nodeWrite() function hashing nodes as 0, which can lead to application crashes following node splits, thereby posing significant risk to application stability and data integrity.

Affected Version(s)

SQLite All platforms where SQLITE_ENABLE_RTREE (or SQLITE_ENABLE_GEOPOLY) is defined 0 < 3.54.0

References

https://sqlite.org/src/info/6a9e1415659f9e75
patch
https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b...
patch
https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude and Ada Logics
Abraxas Labs
Dan Kennedy
.