CVE-2026-119372

SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()

Published Oct 30, 2026 CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Description
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
Title SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
First Time appeared Sqlite
Sqlite sqlite
Weaknesses CWE-416
CPEs cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
Vendors & Products Sqlite
Sqlite sqlite
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 4, 2026, 2:06 AM
Reserved
Oct 30, 2026, 12:39 AM
Status
Modified
Published
Oct 30, 2026, 12:16 PM
Modified
Nov 4, 2026, 2:17 AM
Severity
Moderate
Public date
Oct 30, 2026, 11:30 AM