← CVE index
Vulnerability record/PUBLISHED/Published Oct 30, 2026 11:31:15 UTC

CVE-2026-119591

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.

Base score6.8/ 10
SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityMedium
Attack vectorLocalAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionPassiveUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector stringCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck
Last updatedOct 30, 2026 11:31:15 UTC
PublishedOct 30, 2026 11:31:15 UTC
ReservedOct 30, 2026 11:20:35 UTC

Credits

  • Ke Han
  • Abraxas Labs
  • D. Richard Hipp