CVE-2019-19880
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of windo…
Published Dec 18, 2019 · updated Oct 14, 2026 · sqlite sqlite
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Dec 18, 2019 · NIST NVD
Detected
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Oct 14, 2026 · NIST NVD
Updated
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux9.0
- cpe netapp/cloud backupversion unspecified
- cpe opensuse/backports sle15.0
- cpe oracle/mysql workbenchversion unspecified
- cpe redhat/enterprise linux desktop6.0
- cpe redhat/enterprise linux server6.0
- cpe redhat/enterprise linux workstation6.0
- cpe siemens/sinec infrastructure network servicesversion unspecified
- cpe sqlite/sqlite3.30.1
- cpe suse/package hubversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2019-19880
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-19880
30-day exploitation probability 6.9%
first.org - NIST NVDVulnerability recordCVE-2019-19880
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
nvd.nist.gov