CVE-2026-119372EUVD-2026-113783GHSA-P82X-8J2G-F2C7
SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.54.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects the SQLite database library, specifically builds before 3.54.0 that include FTS3/FTS4 full-text search with the parenthesis option enabled. An attacker who can submit a crafted full-text search query can trigger a use-after-free that reads freed memory and crashes the application using it.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- SQLite SQLite
fixed in 3.54.0