AZL-111784: CVE-2026-119378 affecting package sqlite 3.44.0-4

Q: What conditions are required to trigger the flaw?

An attacker must be able to supply or manipulate a SQLite database containing an R-Tree table and its %_node shadow table. The database must declare %_node WITHOUT ROWID or include a RAISE(IGNORE) trigger, and the crash occurs after node splits.

Q: What is the practical impact described for exploitation?

The flaw can cause the application to use freed heap memory and crash the process after R-Tree node splits. The provided information does not establish impacts beyond the use-after-free and process crash.

Q: Which SQLite installations should be prioritized for remediation?

SQLite versions before 3.54.0 are described as affected. The listed Azure Linux package is sqlite 3.44.0-4.

Published Oct 30, 2026

Updated

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %node shadow table. Attackers can supply a database declaring %node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.

Affected Software

1 affected component

azure-linux/sqlite<=3.44.0-4

Event History

Oct 30, 2026

Advisory Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119378

Frequently Asked Questions

What conditions are required to trigger the flaw?

An attacker must be able to supply or manipulate a SQLite database containing an R-Tree table and its %_node shadow table. The database must declare %_node WITHOUT ROWID or include a RAISE(IGNORE) trigger, and the crash occurs after node splits.

What is the practical impact described for exploitation?

The flaw can cause the application to use freed heap memory and crash the process after R-Tree node splits. The provided information does not establish impacts beyond the use-after-free and process crash.

Which SQLite installations should be prioritized for remediation?

SQLite versions before 3.54.0 are described as affected. The listed Azure Linux package is sqlite 3.44.0-4.

AZL-111784: CVE-2026-119378 affecting package sqlite 3.44.0-4

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required to trigger the flaw?

What is the practical impact described for exploitation?

Which SQLite installations should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the flaw?

What is the practical impact described for exploitation?

Which SQLite installations should be prioritized for remediation?