CVE-2026-54620CWE-416

CVE-2026-54620

published July 28, 2026

CVSS
2.0
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

The record
Technical detail
CVSS
2.0 · NONE
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-416 · Use After Free
Published
2026-07-28T21:16Z
References (4)
https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726 · [email protected]https://github.com/sparklemotion/sqlite3-ruby/pull/711 · [email protected]https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5 · [email protected]https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3 · [email protected]
EPSS history
Timeline
  • 28 JUL 16:23Z
    sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
    cvelistv5