CVE-2026-119372

MediumCVSS 5.5/10Last modified Nov 4, 2026

Description

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
SQLite	SQLite	< 3.54.0

References

https://abraxaslabs.tech/research/sqlite-fts3-snippetExploit, Third Party Advisory
https://github.com/sqlite/sqliteProduct
https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561Patch
https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731Patch
https://sqlite.org/bugs/info/2026-08-17T09:18:24ZIssue Tracking, Patch, Vendor Advisory
https://sqlite.org/releaselog/3_54_0.htmlRelease Notes
https://sqlite.org/src/info/e4635c4153Patch, Vendor Advisory
https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippetThird Party Advisory
https://sqlite.org/bugs/info/2026-08-17T09:18:24ZIssue Tracking, Patch, Vendor Advisory

Timeline

Published: Oct 30, 2026
Last modified: Nov 4, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1193737.8SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging CVE-2026-1193747.8SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf pa CVE-2026-1193755.5SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by suppl CVE-2026-1193765.5SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining CVE-2026-1193773.3SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined ta CVE-2026-1193785.5SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed he CVE-2026-1193797.8SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows CVE-2026-1193827.8Heap-based buffer overflow in Windows TPM allows an authorized attacker to elevate privileges locally.CVE-2026-1193836.6Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.CVE-2026-1193854.7Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker CVE-2026-1193867.0Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.CVE-2026-1193877.0Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.