sqlite

Disclosed vulnerabilities where the NVD names sqlite as an affected vendor, highest CVSS first.

1. HIGH 7.8CVE-2026-119586public PoC2026-10-30

   SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE s…

   sqlite

   AI risk analysis on Exploit-DB.ai →

2. HIGH 7.8CVE-2026-119379public PoC2026-10-30

   SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changese…

   sqlite

   AI risk analysis on Exploit-DB.ai →

3. HIGH 7.8CVE-2026-119374public PoC2026-10-30

   SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when de…

   sqlite

   AI risk analysis on Exploit-DB.ai →

4. HIGH 7.8CVE-2026-119373public PoC2026-10-30

   SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix …

   sqlite

   AI risk analysis on Exploit-DB.ai →

5. MEDIUM 5.5CVE-2026-119591public PoC2026-10-30

   SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can tr…

   sqlite

   AI risk analysis on Exploit-DB.ai →

6. MEDIUM 5.5CVE-2026-119378public PoC2026-10-30

   SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or wit…

   sqlite

   AI risk analysis on Exploit-DB.ai →

7. MEDIUM 5.5CVE-2026-119376public PoC2026-10-30

   SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted databa…

   sqlite

   AI risk analysis on Exploit-DB.ai →

8. MEDIUM 5.5CVE-2026-119375public PoC2026-10-30

   SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload…

   sqlite

   AI risk analysis on Exploit-DB.ai →

9. MEDIUM 5.5CVE-2026-119372public PoC2026-10-30

   SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operator…

   sqlite

   AI risk analysis on Exploit-DB.ai →

10. MEDIUM 5.5CVE-2026-119371public PoC2026-10-30

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands …

    sqlite

    AI risk analysis on Exploit-DB.ai →

11. LOW 2.5CVE-2026-119377public PoC2026-10-30

    SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns…

    sqlite

    AI risk analysis on Exploit-DB.ai →