UBUNTU-CVE-2026-119372: SQL Injection
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITEENABLEFTS3PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.54.0
Event History
Frequently Asked Questions
Which SQLite builds need to be evaluated?
Evaluate SQLite versions before 3.54.0 only where FTS3 or FTS4 is built in and SQLITE_ENABLE_FTS3_PARENTHESIS is enabled. The provided data does not establish whether this is enabled in any default Ubuntu package configuration.
What must an attacker be able to do to trigger the issue?
An attacker needs to cause execution of a full-text MATCH query that combines OR and NEAR operators and uses snippet(). The listed attack vector is local and user interaction is required.
What is the operational impact if exploitation succeeds?
The issue can expose freed heap memory and crash the affected process. The supplied severity vector indicates no confidentiality or integrity impact, but high availability impact.