CVE-2026-54620
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The sqlite3 Ruby bindings for SQLite3 from version 2.1.0 to 2.9.4 contain a use-after-free vulnerability in callbacks used for SQLite aggregate functions. Callbacks can be freed while still referenced during aggregation, leading to memory corruption.
Risk Assessment
An attacker could exploit this to execute arbitrary code or cause application crashes, potentially leading to system compromise.
Recommendation
Immediately update the sqlite3 library to version 2.9.5, which contains the fix for this vulnerability.
Other vulnerabilities in sqlite3
See all- CVE-2019-8457Critical
SQLite3 from version 3.6.0 to 3.27.2 inclusive is vulnerable to a heap out-of-bounds read in the rtreenode() function when handling invalid rtree tables.
- CVE-2026-54619Low
The sqlite3 Ruby bindings for SQLite3 in version 2.9.4 and earlier contain a use-after-free vulnerability when redefining a SQLite function with a different arity. The previously registered function handler is freed while SQLite may still reference it, leading to memory corruption.
Original NVD description (English source)
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS