CVE-2026-119591
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
Risk Assessment
An attacker can crash the application process using SQLite, causing denial of service. This can disrupt availability of services and systems relying on the database.
Recommendation
Update SQLite to version 3.54.0 or later. Until patched, avoid processing untrusted database files or SQL queries from untrusted sources.
Other vulnerabilities in SQLite
See all- CVE-2017-7127High
An issue was discovered in certain Apple products related to the 'SQLite' component. Affects iOS before 11, macOS before 10.13, iCloud before 7.0 on Windows, tvOS before 11, and watchOS before 4.
- CVE-2017-15286High
SQLite version 3.20.1 has a NULL pointer dereference in the tableColumnList function in shell.c. This issue occurs because certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false are not considered, leading to an uninitialized data structure.
- CVE-2017-6991High
An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, involving the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
- CVE-2017-6983High
An issue was discovered in certain Apple products, including iOS before 10.3.2 and macOS before 10.12.5, related to the 'SQLite' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
- CVE-2015-5895High
Multiple unspecified vulnerabilities in SQLite before version 3.8.10.2, as used in Apple iOS before version 9, may lead to unknown impact and attack vectors.
- CVE-2015-3717High
Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash).
- CVE-2015-3416High
The sqlite3VXPrintf function in SQLite before version 3.8.9 does not properly handle precision and width values during floating-point conversions, which can lead to integer overflow and stack-based buffer overflow. Attackers can exploit this in context to cause denial of service or potentially other unspecified impacts.
- CVE-2015-3415High
The sqlite3VdbeExec function in SQLite before version 3.8.9 does not properly implement comparison operators, allowing attackers to cause a denial of service or potentially other unspecified impacts via a crafted CHECK clause.
- CVE-2015-3414High
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, allowing context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause.
- CVE-2025-71316Critical
SQLite 'sqldiff.exe' does not securely handle Unicode to ANSI codepage conversion on Windows, allowing an attacker to load an arbitrary DLL via the '-L' option and misinterpret command line arguments.
Original NVD description (English source)
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS