CVE-2026-119372Medium· 5.5▾ SunlitSQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combini…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
SQLite < 3.54.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119591Medium· 5.5SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
CVE-2026-119377Low· 2.5SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
CVE-2026-119376Medium· 5.5SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
CVE-2026-119373High· 7.8SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
CVE-2024-0232Medium· 4.7A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c
CVE-2021-20227Medium· 5.5A flaw was found in SQLite's SELECT query functionality (src/select.c)