CVE-2026-119372
Received Received - Intake

SQLite FTS3 Use-After-Free in MATCH Query Processing

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119372
EUVD
EUVD-2026-113783

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SQLite SQLite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in SQLite's FTS3/FTS4 extension. It occurs in the snippet() function when fts3BestSnippet caches pointers to position lists. A later phrase triggers buffer reallocation, invalidating these pointers. Dereferencing them causes memory corruption. The issue requires SQLite compiled with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS. Attackers can craft a MATCH query with OR and NEAR operators to exploit this.

Detection Guidance

Detecting this vulnerability requires checking SQLite version and testing specific query patterns. First, verify SQLite version with: sqlite3 --version. If version is before 3.54.0, the system is vulnerable. Test for the issue by creating an FTS4 table and running a MATCH query combining OR and NEAR operators with snippet(). Example: CREATE VIRTUAL TABLE test USING fts4(); INSERT INTO test VALUES('sample text'); SELECT snippet(test) FROM test WHERE test MATCH 'sample OR text NEAR 5'; If the process crashes, the vulnerability is present.

Impact Analysis

This vulnerability allows attackers to read freed heap memory and crash the SQLite process. It can lead to denial of service (DoS) by causing the application to terminate unexpectedly. While not directly enabling remote code execution, it may expose sensitive data in memory or disrupt services relying on SQLite databases.

Mitigation Strategies

Immediate mitigation requires upgrading SQLite to version 3.54.0 or later. Download the latest version from SQLite's official website and replace the existing binary. If upgrading is not immediately possible, disable FTS3/FTS4 extensions by recompiling SQLite without SQLITE_ENABLE_FTS3_PARENTHESIS. Alternatively, avoid using the snippet() function in FTS3/FTS4 queries until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119372. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart