SQLite

Products

Exploited and recent CVEs

• CVE-2026-119591 Medium 5.5 SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause 0.2%
• CVE-2026-119586 High 7.8 SQLite CLI through 3.54.1 Command Injection via .recover Output 1.5%
• CVE-2026-119379 High 7.8 SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind() 0.3%
• CVE-2026-119378 Medium 5.5 SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite() 0.3%
• CVE-2026-119377 Low 2.5 SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING 0.1%
• CVE-2026-119376 Medium 5.5 SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain 0.2%
• CVE-2026-119375 Medium 5.5 SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch 0.2%
• CVE-2026-119374 High 7.8 SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete() 0.2%
• CVE-2026-119373 High 7.8 SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists() 0.2%
• CVE-2026-119372 Medium 5.5 SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet() 0.1%
• CVE-2026-119371 Medium 5.5 SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander() 0.2%
• CVE-2026-11824 High 7.8 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate 0.2%
• CVE-2026-11822 Medium 5.5 SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek 0.2%
• CVE-2025-71316 Critical 9.8 SQLite sqldiff remote code execution via argument injection 0.5%
• CVE-2025-7709 Medium 6.9 Out Of Bounds write in FTS5 Extension in SQLite 0.4%
• CVE-2025-7458 Medium 6.9 SQLite integer overflow in key info allocation may lead to information disclosure. 0.4%
• CVE-2025-6965 High 7.2 Integer Truncation on SQLite 73.5%
• CVE-2025-3277 Medium 6.9 An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, 1.3%
• CVE-2025-29088 Medium 5.6 In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bi 0.2%
• CVE-2025-29087 Low 3.2 In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled 0.5%
• CVE-2023-7104 Medium 5.5 SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow 1.5%