CVE-2026-119591: SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count() over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TKPLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
Other sources
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
— Microsoft
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using SQLite before 3.54.0 are exposed if they process attacker-supplied SQL or open a database file containing an attacker-crafted view. The impact described is a crash of the host process.
What does an attacker need to trigger the crash?
The attacker needs a path to supply SQL, or to provide a database file with a crafted view. The trigger uses count(*) over a large multi-row VALUES clause, producing deeply nested TK_PLUS expressions.
Are confidentiality or data-integrity impacts described?
No. The provided vector and description identify availability impact through stack exhaustion and host-process denial of service, with no confidentiality or integrity impact stated.
How can I determine whether my deployment is affected?
Check whether the SQLite version in use is earlier than 3.54.0 and whether the application accepts untrusted SQL or untrusted SQLite database files. Those conditions match the affected versions and attack paths described.