{"id":"CVE-2026-119378","title":"SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()","summary":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_no…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-416"],"vendor":"SQLite","product":"SQLite","affected":["SQLite < 3.54.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T15:20:53.674733Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T15:56:16.807Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119378","references":[{"url":"https://sqlite.org/src/info/6a9e1415659f9e75"},{"url":"https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04"},{"url":"https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905"},{"url":"https://sqlite.org/releaselog/3_54_0.html"},{"url":"https://abraxaslabs.tech/research/sqlite-rtree-rowid0"},{"url":"https://github.com/sqlite/sqlite"},{"url":"https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite","label":"VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()"}],"tags":["cve.org"],"epss":0.00251,"epssPercentile":0.16533,"ingestedAt":"2026-11-05T16:24:31.045Z","slug":"CVE-2026-119378","body":"## Overview\n\nSQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.\n\n## Affected\n\n- `SQLite < 3.54.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}