CVE-2026-119378: SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()

Published Oct 30, 2026

Updated

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %node shadow table. Attackers can supply a database declaring %node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.

Other sources

SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()

— Microsoft

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Oct 31, 2026

Data Sourced

via Microsoft·08:05 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are realistically exposed?

Applications using SQLite versions before 3.54.0 with the R-Tree extension are exposed when an attacker can supply or modify a database schema containing the R-Tree %_node shadow table. The described attack relies on a %_node table declared WITHOUT ROWID or equipped with a RAISE(IGNORE) trigger.

What does an attacker need to trigger the issue?

The attacker needs to manipulate the R-Tree %_node shadow table so that nodeWrite() hashes nodes as 0. The crash occurs after R-Tree node splits, so the affected application must perform operations that cause a node split.

Is this a remote unauthenticated vulnerability?

No. The supplied vector lists local attack access and user interaction as required. The available data describes exploitation through a crafted or manipulated SQLite database rather than a network-facing SQLite service.

What can be done if upgrading is not immediately possible?

Do not open or permit modification of attacker-controlled SQLite databases that use R-Tree tables, especially databases whose %_node shadow table is WITHOUT ROWID or has a RAISE(IGNORE) trigger. Limit access to database files and prevent untrusted SQL or schema changes.

How can I determine whether a database is a potential trigger?

Inspect R-Tree %_node shadow-table definitions for a WITHOUT ROWID declaration or RAISE(IGNORE) trigger. Databases with either condition may cause nodeWrite() to hash nodes as 0 under the described conditions.

CVE-2026-119378: SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()

Other sources

Event History

Frequently Asked Questions

Which applications are realistically exposed?

What does an attacker need to trigger the issue?

Is this a remote unauthenticated vulnerability?

What can be done if upgrading is not immediately possible?

How can I determine whether a database is a potential trigger?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed?

What does an attacker need to trigger the issue?

Is this a remote unauthenticated vulnerability?

What can be done if upgrading is not immediately possible?

How can I determine whether a database is a potential trigger?