CVE-2017-15286 Null dereference in n/a

What is CVE-2017-15286?

CVE-2017-15286 is a high-severity vulnerability in Sqlite Sqlite, published on 12 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized.

Weakness: CWE-476

Which versions are affected by CVE-2017-15286?

It affects 1 product.

Products include Sqlite Sqlite.

How do I fix CVE-2017-15286?

Upgrade to a fixed version.

Is CVE-2017-15286 being exploited?

There is no known exploitation of CVE-2017-15286 in the wild and no public exploit code.

Other vulnerabilities in Sqlite Sqlite

• CVE-2015-5895 Other in n/a Critical 10.0
• CVE-2017-10989 Memory corruption in n/a Critical 9.8
• CVE-2026-11822 SQLite before 3.53.2 Memory Corruption in FTS5 Extension High 8.5
• CVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate High 8.5
• CVE-2025-70873 Information disclosure in n/a High 7.5

All Sqlite Sqlite vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2017-15286, DEBIAN-CVE-2017-15286, GHSA-cmxm-6c5m-r5c5.