CVE-2026-119372: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()

Published Oct 30, 2026

Updated

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITEENABLEFTS3PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.

Other sources

SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()

— Microsoft

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SQLite to a version that resolves this vulnerability.
Fixed in 3.54.0

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Oct 31, 2026

Data Sourced

via Microsoft·08:04 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected deployments use SQLite versions before 3.54.0, are built with FTS3 or FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS, and execute queries against full-text search tables using snippet().

What must an attacker be able to do to exploit this issue?

An attacker needs to be able to run a full-text MATCH query that combines OR and NEAR operators with snippet(). The provided severity vector indicates local attack vector, no privileges required, and user interaction required.

What is the expected impact of successful exploitation?

Successful exploitation can read freed heap memory and crash the SQLite-using process. The provided vector rates availability impact as high and confidentiality and integrity impact as none.

How can exposure be reduced if an upgrade is not immediately possible?

Avoid allowing untrusted parties to execute the affected full-text MATCH query patterns, particularly queries combining OR and NEAR with snippet(). Restrict access to functionality that can issue these SQL queries.

CVE-2026-119372: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()

Other sources

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker be able to do to exploit this issue?

What is the expected impact of successful exploitation?

How can exposure be reduced if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker be able to do to exploit this issue?

What is the expected impact of successful exploitation?

How can exposure be reduced if an upgrade is not immediately possible?