Use-After-Free Vulnerability in SQLite3 Ruby Bindings Affects Sparklemotion
CVE-2026-54619

2LOW

Key Information:

Vendor

Sparklemotion

Status
Sqlite3-ruby
Vendor
CVE Published:
28 July 2026

What is CVE-2026-54619?

The SQLite3 Ruby bindings, developed by Sparklemotion, exhibit a vulnerability where redefining a SQLite function with a different arity can inadvertently free a previously registered function handler. This leaves the application in a state where SQLite may still attempt to reference the freed handler, leading to potential instability or exploitation. This issue has been addressed in version 2.9.5 of the SQLite3 Ruby bindings.

Affected Version(s)

sqlite3-ruby < 2.9.5

References

https://github.com/sparklemotion/sqlite3-ruby/security/ad...
x_refsource_CONFIRM
https://github.com/sparklemotion/sqlite3-ruby/pull/710
x_refsource_MISC
https://github.com/sparklemotion/sqlite3-ruby/commit/2bd4...
x_refsource_MISC

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.