CVE-2019-5018

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0.

Published May 10, 2019 · updated Oct 14, 2026 · sqlite sqlite

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

May 10, 2019 · NIST NVD
Detected
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
Oct 14, 2026 · NIST NVD
Updated
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

Affected

cpe canonical/ubuntu linux12.04
cpe canonical/ubuntu linux16.04
cpe canonical/ubuntu linux18.04
cpe canonical/ubuntu linux19.04
cpe canonical/ubuntu linux19.10
cpe sqlite/sqlite3.26.0

Sources

CVE.orgVulnerability recordCVE-2019-5018
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2019-5018
30-day exploitation probability 6.7%
first.org
NIST NVDVulnerability recordCVE-2019-5018
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to tri
nvd.nist.gov
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/152809/Sqlite3-Window-Function-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com