CVE-2026-119372 in SQLite
Summary
by MITRE • 10/30/2026
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The SQLite database engine, prior to version 3.54.0, contains a critical use-after-free vulnerability within its Full-Text Search (FTS) implementation when compiled with FTS3 or FTS4 support enabled alongside the SQLITE_ENABLE_FTS3_PARENTHESIS configuration option. This specific flaw resides in the fts3BestSnippet() function, which is responsible for generating snippet outputs that highlight matching terms within search results. The root cause of this vulnerability lies in improper memory management regarding cached position-list pointers used during the parsing and execution of complex full-text queries. When an attacker constructs a query utilizing both OR and NEAR operators combined with the snippet() function, the internal logic fails to correctly track the lifecycle of these pointer structures. Consequently, the system may attempt to access or dereference memory locations that have already been freed by other parts of the search engine's garbage collection or allocation routines.
From a technical perspective, this is classified as CWE-416: Use After Free, which occurs when software uses an address in memory after it has been reused for another purpose. In the context of SQLite, position-list pointers are critical data structures that map term occurrences to specific locations within documents. When these pointers become dangling due to premature deallocation or failure to update references during complex query optimization involving logical operators like OR and proximity constraints like NEAR, subsequent calls to fts3BestSnippet() will read from invalid memory addresses. This behavior leads directly to CWE-125: Out-of-bounds Read, as the application attempts to retrieve data from heap regions that no longer belong to the active process context or have been reallocated for unrelated operations.
The operational impact of this vulnerability is severe and multifaceted. Primarily, it allows an attacker who can execute arbitrary SQL queries against a vulnerable SQLite instance to perform unauthorized memory reads. By carefully crafting payloads that trigger the use-after-free condition in fts3BestSnippet(), an adversary can leak sensitive information stored in adjacent heap memory, such as authentication tokens, private keys, or other application data previously allocated and subsequently freed. Furthermore, because reading from invalid memory often results in segmentation faults or access violations, this vulnerability also serves as a reliable denial-of-service vector. An attacker can repeatedly trigger the crash condition to destabilize the hosting process, effectively rendering the database service unavailable to legitimate users without requiring any form of privilege escalation beyond what is needed to submit SQL queries.
This exploit scenario aligns with several tactics and techniques defined in the MITRE ATT&CK framework. The ability to read arbitrary memory corresponds to T1005: Data from Local System, where an adversary seeks to collect data directly from a compromised system without network communication. Additionally, causing the process to crash via repeated exploitation attempts falls under T1499: Endpoint Denial of Service. If the SQLite instance is embedded within a larger application that handles untrusted input or serves multiple tenants, this vulnerability could potentially be chained with other flaws to achieve remote code execution, although the primary documented impact remains information disclosure and service disruption.
Mitigation strategies for this vulnerability are straightforward but require immediate action from system administrators and developers maintaining affected software stacks. The definitive remediation is to upgrade SQLite to version 3.54.0 or later, where the memory management logic in fts3BestSnippet() has been corrected to properly handle reference counting and pointer validity checks during complex query execution. For environments where upgrading is not immediately feasible, administrators should consider disabling FTS3/FTS4 support if full-text search capabilities are not strictly required by compiling SQLite without these features or specifically excluding the SQLITE_ENABLE_FTS3_PARENTHESIS flag. Additionally, implementing strict input validation and sanitization on SQL queries can reduce the attack surface, although this is a defensive measure rather than a fix for the underlying memory corruption flaw. Regular security audits of database interaction layers are recommended to ensure that complex query constructs do not inadvertently trigger such low-level memory errors in legacy or unpatched systems.