SQLite EUVD-2026-113783

Requires SQLite compiled with FTS3/FTS4 support AND the non-default compile-time option SQLITE_ENABLE_FTS3_PARENTHESIS, and an FTS3/FTS4 virtual table the attacker can query. The attacker must be able to execute a full-text MATCH query that combines OR and NEAR operators together with a snippet() call (e.g. MATCH '"a" OR "" bbb NEAR 0 NEAR 1' with snippet()). Limiting factors: this is not reachable at the SQLite layer over a network by itself (AV:L) - an attacker needs the ability to run/influence SQL against the FTS table via the host application; the required FTS3_PARENTHESIS build flag is not enabled in default SQLite builds, substantially narrowing the exposed population; impact is limited to a crash (DoS) with no confirmed code execution or integrity impact.

This is a genuine but moderate-priority issue (CVSS 4.0 base 6.8, Medium), not a drop-everything emergency, and the signals are largely consistent. The vendor CVSS vector is AV:L/AC:L/PR:N/UI:P with only availability impact (VA:H; VC:N/VI:N), meaning the realistic outcome is a process crash/denial of service rather than code execution or data theft. It is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', indicating routine patching urgency rather than act_now/emergency. A public PoC reference exists (abraxaslabs research writeup plus a reproducing regression test added in the fix), so the trigger is well understood, but it is not verified as weaponized exploit code. One notable tension: the description states the flaw lets an attacker 'read freed heap memory', which implies a possible information-disclosure angle, yet the vendor vector sets VC:N (no confidentiality impact) and treats it purely as a crash - this discrepancy should be verified with the vendor/VulnCheck advisory before ruling out any heap-content leakage into snippet() output. Overall: a real DoS bug constrained to a non-default build configuration and local SQL-execution reach, warranting patching on a normal cycle, not crisis response.

An attacker able to submit crafted full-text search queries to an application that uses SQLite built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS runs a MATCH query combining OR and NEAR operators together with snippet(), causing fts3BestSnippet() to follow dangling cached position-list pointers. This reads freed heap memory and crashes the hosting process, producing a denial of service. A public PoC reference and a concrete reproducing query exist, but are not verified as working weaponized exploit code.