{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119372", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T00:39:32.365Z", "datePublished": "2026-10-30T11:30:38.453Z", "dateUpdated": "2026-11-04T02:06:19.621Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:38.453Z"}, "datePublic": "2026-08-17T00:00:00.000Z", "title": "SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()", "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use After Free", "cweId": "CWE-416", "type": "CWE"}]}], "affected": [{"vendor": "SQLite", "product": "SQLite", "collectionURL": "https://sqlite.org/", "repo": "https://github.com/sqlite/sqlite", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThan": "3.54.0"}], "platforms": ["All platforms where SQLITE_ENABLE_FTS3 (or SQLITE_ENABLE_FTS4) and SQLITE_ENABLE_FTS3_PARENTHESIS are defined"]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.54.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z", "tags": ["issue-tracking"]}, {"url": "https://sqlite.org/src/info/e4635c4153", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561", "tags": ["technical-description"]}, {"url": "https://sqlite.org/releaselog/3_54_0.html", "tags": ["release-notes"]}, {"url": "https://abraxaslabs.tech/research/sqlite-fts3-snippet", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sqlite/sqlite", "tags": ["product"]}, {"name": "VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"}], "credits": [{"lang": "en", "value": "Marc Heuse", "type": "finder"}, {"lang": "en", "value": "Abraxas Labs", "type": "reporter"}, {"lang": "en", "value": "Dan Kennedy", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T02:05:58.253010Z", "id": "CVE-2026-119372", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T02:06:19.621Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119372", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T02:05:58.253010Z"}}}], "references": [{"url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T02:06:13.604Z"}}], "cna": {"title": "SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()", "credits": [{"lang": "en", "type": "finder", "value": "Marc Heuse"}, {"lang": "en", "type": "reporter", "value": "Abraxas Labs"}, {"lang": "en", "type": "remediation developer", "value": "Dan Kennedy"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/sqlite/sqlite", "vendor": "SQLite", "product": "SQLite", "versions": [{"status": "affected", "version": "0", "lessThan": "3.54.0", "versionType": "custom"}], "platforms": ["All platforms where SQLITE_ENABLE_FTS3 (or SQLITE_ENABLE_FTS4) and SQLITE_ENABLE_FTS3_PARENTHESIS are defined"], "collectionURL": "https://sqlite.org/", "defaultStatus": "unaffected"}], "datePublic": "2026-08-17T00:00:00.000Z", "references": [{"url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z", "tags": ["issue-tracking"]}, {"url": "https://sqlite.org/src/info/e4635c4153", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561", "tags": ["technical-description"]}, {"url": "https://sqlite.org/releaselog/3_54_0.html", "tags": ["release-notes"]}, {"url": "https://abraxaslabs.tech/research/sqlite-fts3-snippet", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sqlite/sqlite", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet", "name": "VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.54.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:38.453Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119372", "state": "PUBLISHED", "dateUpdated": "2026-11-04T02:06:19.621Z", "dateReserved": "2026-10-30T00:39:32.365Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T11:30:38.453Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://sqlite.org/", "defaultStatus": "unaffected", "platforms": ["All platforms where SQLITE_ENABLE_FTS3 (or SQLITE_ENABLE_FTS4) and SQLITE_ENABLE_FTS3_PARENTHESIS are defined"], "product": "SQLite", "repo": "https://github.com/sqlite/sqlite", "vendor": "SQLite", "versions": [{"lessThan": "3.54.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D7328A9-932D-4FD4-8F44-90B87CAA8C4A", "versionEndExcluding": "3.54.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."}], "id": "CVE-2026-119372", "lastModified": "2026-11-04T02:17:19.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119372", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T02:05:58.253010Z", "version": "2.0.3"}}]}, "published": "2026-10-30T12:16:35.873", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://abraxaslabs.tech/research/sqlite-fts3-snippet"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/sqlite/sqlite"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z"}, {"source": "disclosure@vulncheck.com", "tags": ["Release Notes"], "url": "https://sqlite.org/releaselog/3_54_0.html"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://sqlite.org/src/info/e4635c4153"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sqlite: sqlite: Denial of Service via use-after-free in full-text search", "id": "2564015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564015"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.", "A flaw was found in SQLite. A use-after-free vulnerability exists in its full-text search extension due to improper handling of cached memory pointers during query processing. An attacker can exploit this issue by executing a specially crafted full-text search query, causing the application to access previously freed memory and crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-119372", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mingw-sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "rust-toolset:rhel8/rust", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:26/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-30T11:30:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119372\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119372\nhttps://abraxaslabs.tech/research/sqlite-fts3-snippet\nhttps://github.com/sqlite/sqlite\nhttps://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561\nhttps://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731\nhttps://sqlite.org/bugs/info/2026-08-17T09:18:24Z\nhttps://sqlite.org/releaselog/3_54_0.html\nhttps://sqlite.org/src/info/e4635c4153\nhttps://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"], "statement": "This vulnerability is evaluated as having a Moderate severity for Red Hat products because the primary impact is limited to denial of service through process crashes, without compromising confidentiality or integrity. SQLite is widely utilized as an embedded library across Red Hat Enterprise Linux, where exploitation requires an application to process untrusted queries leveraging full-text search and snippet extraction. Applications that do not expose arbitrary search queries to untrusted users or do not utilize the vulnerable full-text search extensions remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["all_platforms_where_sqlite_enable_fts3_(or_sqlite_enable_fts4)_and_sqlite_enable_fts3_parenthesis_are_defined"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.54.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "SQLite", "source": "cna", "vendor": "SQLite"}, "product": "sqlite", "vendor": "sqlite"}], "created": "2026-10-30T12:30:14.124892+00:00", "updated": "2026-11-06T02:30:14.087663+00:00", "vendors": ["sqlite", "sqlite$PRODUCT$sqlite"]}