CVE-2019-5018
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0.
Published May 10, 2019 · updated Oct 14, 2026 · sqlite sqlite
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
Timeline
Detection, updates, and resolution for this record.
May 10, 2019 · NIST NVD
Detected
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
Oct 14, 2026 · NIST NVD
Updated
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
Affected
- cpe canonical/ubuntu linux12.04
- cpe canonical/ubuntu linux16.04
- cpe canonical/ubuntu linux18.04
- cpe canonical/ubuntu linux19.04
- cpe canonical/ubuntu linux19.10
- cpe sqlite/sqlite3.26.0
Sources
- CVE.orgCVE-2019-5018
Official CVE identifier
cve.org - NIST NVDCVE-2019-5018
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to tri
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/152809/Sqlite3-Window-Function-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com