Live › vulnerability › CVE-2026-119372
SQLite builds with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS have a use-after-free in fts3BestSnippet() caused by dangling cached position-list pointers. A crafted full-text MATCH query using OR and NEAR with snippet() can read freed heap memory and crash the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Only builds of SQLite before 3.54.0 that enable FTS3/FTS4 together with SQLITE_ENABLE_FTS3_PARENTHESIS are exposed. The attacker must be able to run a MATCH query with OR and NEAR against a FTS table and call snippet(), so applications that accept untrusted search input over such tables are the ones to look at. Applications on default builds or without FTS3/FTS4 can skip it.
No product ranges from the sources yet.
sqlite3 --version, and compare it with the fixed release.SQLITE_ENABLE_FTS3_PARENTHESIS and uses FTS3 or FTS4 tables.3.54.0: move to 3.54.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-119372")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.