Live › vulnerability › CVE-2026-119378
SQLite before 3.54.0 has a use-after-free bug in its R-Tree extension, triggered by a crafted database whose %_node shadow table is set up in a specific way. An attacker who can get an application to open such a database can make it use freed heap memory, crashing the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that link SQLite older than 3.54.0 with the R-Tree extension and open databases from untrusted sources can be affected. Sources do not say whether the R-Tree extension must be enabled by default in common builds, so unknown. Teams that only open their own trusted databases can likely deprioritise it.
No product ranges from the sources yet.
sqlite3 --version or check the bundled SQLite version of each application that opens databases3.54.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
This page as .md · .json · in your agent: get_signal("CVE-2026-119378")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.