CVE-2019-5018

PoC —

CVSS 3.1

8.1 high

EPSS

7%p93

Published

May 10, 2019 (May 10, 2019)

Modified

Jun 17, 2026

Description

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

Vendors: sqlite canonical
Products: sqlite, ubuntu linux
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (6.7%)

In the news2 stories

Experts found a remote

Security AffairsMay 11, 21:27 UTC · May 11, 2019Vulnerability CVE-2019-5018

Vulnerability Spotlight: Remote code execution bug in SQLite

Cisco TalosMay 9, 13:30 UTC · May 9, 2019Vulnerability CVE-2019-50181