CVE-2026-54619
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The sqlite3 Ruby bindings for SQLite3 in version 2.9.4 and earlier contain a use-after-free vulnerability when redefining a SQLite function with a different arity. The previously registered function handler is freed while SQLite may still reference it, leading to memory corruption.
Risk Assessment
An attacker could exploit this to execute arbitrary code or cause application crashes, potentially leading to system compromise.
Recommendation
Immediately update the sqlite3 library to version 2.9.5, which contains the fix for this vulnerability.
Original NVD description (English source)
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.