CVE-2026-69867
HighCVSS 7.8Summary
Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker could exploit the flaw to access data or escalate privileges on the system.
Recommendation
Update SQLite to the latest version.
Other vulnerabilities in SQLite
See all- CVE-2017-7127High
An issue was discovered in certain Apple products related to the 'SQLite' component. Affects iOS before 11, macOS before 10.13, iCloud before 7.0 on Windows, tvOS before 11, and watchOS before 4.
- CVE-2017-15286High
SQLite version 3.20.1 has a NULL pointer dereference in the tableColumnList function in shell.c. This issue occurs because certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false are not considered, leading to an uninitialized data structure.
- CVE-2017-6991High
An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, involving the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
- CVE-2017-6983High
An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, related to the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
- CVE-2015-5895High
Multiple unspecified vulnerabilities in SQLite before version 3.8.10.2, as used in Apple iOS before version 9, may lead to unknown impact and attack vectors.
- CVE-2015-3717High
Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash).
- CVE-2015-3416High
The sqlite3VXPrintf function in SQLite before version 3.8.9 does not properly handle precision and width values during floating-point conversions, which can lead to integer overflow and stack-based buffer overflow. Attackers can exploit this in context to cause denial of service or potentially other unspecified impacts.
- CVE-2015-3415High
The sqlite3VdbeExec function in SQLite before version 3.8.9 does not properly implement comparison operators, allowing attackers to cause a denial of service or potentially other unspecified impacts via a crafted CHECK clause.
- CVE-2015-3414High
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, allowing context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause.
- CVE-2023-7104High
A critical vulnerability was found in SQLite3 up to version 3.43.0 in the sessionReadRecord function of ext/session/sqlite3session.c. Manipulation leads to a heap-based buffer overflow, potentially allowing remote code execution.
Original NVD description (English source)
Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS