SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.

Etkilenen sürümler1 yazılım

Kaynaklar10 kaynak

• CVE.org kaydı
• NVD kaydı
• sqlite.org/src/info/e4635c4153 Yama
• github.com/…ommit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731 Yama
• sqlite.org/bugs/info/2026-08-17T09:18:24Z Üçüncü taraf
• abraxaslabs.tech/research/sqlite-fts3-snippet Üçüncü taraf
• vulncheck.com/…after-free-in-fts3-fts3bestsnippet-via-snippet Üçüncü taraf
• github.com/…te/blob/version-3.53.4/ext/fts3/fts3_snippet.c Diğer
• sqlite.org/releaselog/3_54_0.html Diğer
• github.com/sqlite/sqlite Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:30Yayımlandı

İlgili açıklar

• 7,8 CVE-2026-119586SQLite CLI through 3.54.1 Command Injection via .recover Output
• 5,5 CVE-2026-119591SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
• 7,8 CVE-2026-119379SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
• 5,5 CVE-2026-119378SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
• 5,5 CVE-2026-119376SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
• 2,5 CVE-2026-119377SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING