ZeroDay Findings
Sign inSign up

Findings

CVE-2020-13871

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

Published Jun 6, 2020 · updated Oct 14, 2026 · sqlite sqlite

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 6, 2020 · NIST NVD

    Detected

    SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

  2. Oct 14, 2026 · NIST NVD

    Updated

    SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

Affected

  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora33
  • cpe netapp/cloud backupversion unspecified
  • cpe oracle/communications messaging server8.1
  • cpe oracle/communications network charging and control12.0.2
  • cpe oracle/communications network charging and control6.0.1
  • cpe oracle/enterprise manager ops center12.4.0.0
  • cpe oracle/hyperion infrastructure technology11.1.2.4
  • cpe siemens/sinec infrastructure network servicesversion unspecified
  • cpe sqlite/sqlite3.32.2

Sources

  • CVE.orgVulnerability recordCVE-2020-13871

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2020-13871

    30-day exploitation probability 4.4%

    first.org
  • NIST NVDVulnerability recordCVE-2020-13871

    SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

    nvd.nist.gov

References