CVE-2019-16168
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Risk Assessment
This can cause applications using SQLite to crash, leading to service unavailability or data loss.
Recommendation
Update SQLite to version 3.30.0 or later, which includes the fix.
Other vulnerabilities in SQLite
See all- CVE-2026-69867High
Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.
- CVE-2017-7127High
An issue was discovered in certain Apple products related to the 'SQLite' component. Affects iOS before 11, macOS before 10.13, iCloud before 7.0 on Windows, tvOS before 11, and watchOS before 4.
- CVE-2017-15286High
SQLite version 3.20.1 has a NULL pointer dereference in the tableColumnList function in shell.c. This issue occurs because certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false are not considered, leading to an uninitialized data structure.
- CVE-2017-6991High
An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, involving the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
- CVE-2017-6983High
An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, related to the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
- CVE-2015-5895High
Multiple unspecified vulnerabilities in SQLite before version 3.8.10.2, as used in Apple iOS before version 9, may lead to unknown impact and attack vectors.
- CVE-2015-3717High
Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash).
- CVE-2015-3416High
The sqlite3VXPrintf function in SQLite before version 3.8.9 does not properly handle precision and width values during floating-point conversions, which can lead to integer overflow and stack-based buffer overflow. Attackers can exploit this in context to cause denial of service or potentially other unspecified impacts.
- CVE-2015-3415High
The sqlite3VdbeExec function in SQLite before version 3.8.9 does not properly implement comparison operators, allowing attackers to cause a denial of service or potentially other unspecified impacts via a crafted CHECK clause.
- CVE-2015-3414High
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, allowing context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause.
Original NVD description (English source)
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS