← CVE index
Vulnerability record/PUBLISHED/Published Oct 30, 2026 11:30:41 UTC

CVE-2026-119376

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

Base score6.8/ 10
SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityMedium
Attack vectorLocalAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionPassiveUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector stringCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck
Last updatedNov 4, 2026 02:07:18 UTC
PublishedOct 30, 2026 11:30:41 UTC
ReservedOct 30, 2026 00:57:05 UTC

Credits

  • Ke Han
  • Abraxas Labs
  • D. Richard Hipp