UBUNTU-CVE-2026-119378: SQL Injection
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %node shadow table. Attackers can supply a database declaring %node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the crash?
The attacker must be able to supply or manipulate a SQLite database containing an R-Tree %_node shadow table declared WITHOUT ROWID or configured with a RAISE(IGNORE) trigger. Exploitation occurs when node splits cause nodeWrite() to hash nodes as 0, leading the application to use freed heap memory and crash.
Which applications are realistically exposed?
Applications using SQLite with the R-Tree extension are exposed if they open attacker-controlled databases or otherwise allow an attacker to manipulate the R-Tree %_node shadow table. The reported impact is process availability: the supplied data describes a crash after node splits, with no confidentiality or integrity impact.
How can I determine whether a database may be malicious or vulnerable to this issue?
Inspect databases that use the R-Tree extension for a %_node shadow table declared WITHOUT ROWID or for a RAISE(IGNORE) trigger affecting that table. Databases with either condition can cause nodeWrite() to hash nodes as 0 during node splits.