ZeroDay Findings
Sign inSign up

Findings

CVE-2019-9936

In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an…

Published Mar 22, 2019 · updated Oct 14, 2026 · sqlite sqlite

In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 22, 2019 · NIST NVD

    Detected

    In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

  2. Oct 14, 2026 · NIST NVD

    Updated

    In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

Affected

  • cpe sqlite/sqlite3.27.2

Sources

  • CVE.orgVulnerability recordCVE-2019-9936

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2019-9936

    30-day exploitation probability 5.3%

    first.org
  • NIST NVDVulnerability recordCVE-2019-9936

    In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

    nvd.nist.gov

References