CVE-2026-119372

EUVD-2026-113783
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
sqlitesqlite
𝑥
< 3.54.0
CNA
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/sqlite-fts3-snippet
https://github.com/sqlite/sqlite
https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561
https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731
https://sqlite.org/bugs/info/2026-08-17T09:18:24Z
https://sqlite.org/releaselog/3_54_0.html
https://sqlite.org/src/info/e4635c4153
https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet