CVE-2019-8457
CriticalSummary
SQLite3 from version 3.6.0 to 3.27.2 inclusive is vulnerable to a heap out-of-bounds read in the rtreenode() function when handling invalid rtree tables.
Risk Assessment
An attacker could exploit this vulnerability to access sensitive data in memory or cause application crashes, potentially leading to information disclosure or service disruption.
Recommendation
It is recommended to immediately upgrade SQLite3 to version 3.28.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in SQLite3
See all- CVE-2026-54620Low
The sqlite3 Ruby bindings for SQLite3 from version 2.1.0 to 2.9.4 contain a use-after-free vulnerability in callbacks used for SQLite aggregate functions. Callbacks can be freed while still referenced during aggregation, leading to memory corruption.
- CVE-2026-54619Low
The sqlite3 Ruby bindings for SQLite3 in version 2.9.4 and earlier contain a use-after-free vulnerability when redefining a SQLite function with a different arity. The previously registered function handler is freed while SQLite may still reference it, leading to memory corruption.
Original NVD description (English source)
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.