SQLite R-Tree CVE-2026-119378

Exploitation requires the victim application to be built with the R-Tree extension (SQLITE_ENABLE_RTREE) and to open/process an attacker-supplied SQLite database whose %_node shadow table has been corrupted - specifically declared WITHOUT ROWID, or given a BEFORE INSERT trigger that calls RAISE(IGNORE) - so that sqlite3_last_insert_rowid() returns 0 after an INSERT. The crash only occurs once the application performs INSERTs large enough to cause an R-Tree node split, making nodeWrite() hash the node with iNode==0. Limiting factors: this is a local vector (AV:L) requiring delivery of a malicious database and application processing of it (UI:P); it does not apply to deployments that never load untrusted databases or that are compiled without R-Tree; and impact is confined to a process crash (denial of service), with no confidentiality or integrity effect.

This is a medium-severity, denial-of-service-only issue, not a high-priority emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.8) tells a consistent story: exploitation is local and requires passive user interaction - the victim application must open and process an attacker-supplied SQLite database - and the only impact is availability (VA:H), with no confidentiality or integrity impact (VC:N/VI:N). Despite the CWE-416 use-after-free classification, the supplied evidence (description, commit message, and test case) shows the observed outcome is a process crash after R-Tree node splits, not code execution; the sources do not demonstrate the UAF being steered toward RCE. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a moderate-urgency fix. No CISA KEV listing is present, so there is no confirmation of active exploitation, and no EPSS score was supplied, so exploitation probability cannot be quantified from this data. A public PoC reference exists (the AbraxasLabs research write-up and the vendor's own regression test reproducing the crash), but it is not verified as working weaponized exploit code. Net: a real, patchable bug worth addressing on a normal cycle, bounded by the need for an attacker-controlled database, an application compiled with the R-Tree extension, and DoS-only impact - not a widespread drive-by threat.

An attacker crafts a malicious SQLite database in which the %_node shadow table is redefined (as WITHOUT ROWID, or carrying a BEFORE INSERT RAISE(IGNORE) trigger) so that after a successful INSERT sqlite3_last_insert_rowid() returns 0. A victim application that uses the R-Tree extension opens this database and performs inserts that cause an R-Tree node split, at which point nodeWrite() hashes the node as 0 and the application reuses freed heap memory, crashing the process. A public PoC reference exists (the vendor regression test and the AbraxasLabs research write-up), though it is not verified as working exploit code.