CVE-2026-54620
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The sqlite3 Ruby bindings for SQLite3 from version 2.1.0 to 2.9.4 contain a use-after-free vulnerability in callbacks used for SQLite aggregate functions. Callbacks can be freed while still referenced during aggregation, leading to memory corruption.
Risk Assessment
An attacker could exploit this to execute arbitrary code or cause application crashes, potentially leading to system compromise.
Recommendation
Immediately update the sqlite3 library to version 2.9.5, which contains the fix for this vulnerability.
Original NVD description (English source)
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.