CVE-2026-119374
Description
A flaw was found in SQLite. When the Full Text Search (FTS5) extension is enabled and secure-delete mode is active, processing a database containing a corrupted search index triggers a heap-based buffer overflow. An attacker who tricks an application or user into opening a crafted database file can exploit this flaw to execute arbitrary code or cause a Denial of Service (DoS) by crashing the application.
Statement
Red Hat rates this vulnerability as Important rather than Moderate because an attacker who successfully tricks a system application or user into interacting with a crafted database can trigger arbitrary code execution in the context of that application. Across Red Hat Enterprise Linux, SQLite is widely deployed as an embedded database library, exposing numerous system utilities and user applications to untrusted database inputs. However, triggering this flaw requires the specific combination of the FTS5 extension and secure deletion mode being active while deleting records, which limits exposure in standard deployments where secure deletion is not enabled or databases are strictly internal.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
