---
id: CVE-2026-119378
title: SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
summary: >-
  SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree
  extension that allows attackers to make applications use freed heap memory by
  manipulating the %_node shadow table. Attackers can supply a database
  declaring %_no…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-416
vendor: SQLite
product: SQLite
affected:
  - SQLite < 3.54.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:20:53.674733Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:56:16.807Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119378'
references:
  - url: 'https://sqlite.org/src/info/6a9e1415659f9e75'
  - url: >-
      https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04
  - url: >-
      https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905
  - url: 'https://sqlite.org/releaselog/3_54_0.html'
  - url: 'https://abraxaslabs.tech/research/sqlite-rtree-rowid0'
  - url: 'https://github.com/sqlite/sqlite'
  - url: >-
      https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite
    label: >-
      VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in R-Tree
      nodeWrite()
tags:
  - cve.org
epss: 0.00251
epssPercentile: 0.16533
ingestedAt: '2026-11-05T16:24:31.045Z'
---

## Overview

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.

## Affected

- `SQLite < 3.54.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.