CVE-2019-9936 Information disclosure in n/a

What is CVE-2019-9936?

CVE-2019-9936 is a high-severity vulnerability in Sqlite Sqlite, published on 22 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

Weakness: CWE-125

Which versions are affected by CVE-2019-9936?

It affects 1 product.

Products include Sqlite Sqlite.

How do I fix CVE-2019-9936?

Upgrade to a fixed version.

Is CVE-2019-9936 being exploited?

There is no known exploitation of CVE-2019-9936 in the wild and no public exploit code.

Other vulnerabilities in Sqlite Sqlite

• CVE-2015-5895 Other in n/a Critical 10.0
• CVE-2017-10989 Memory corruption in n/a Critical 9.8
• CVE-2026-11822 SQLite before 3.53.2 Memory Corruption in FTS5 Extension High 8.5
• CVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate High 8.5
• CVE-2025-70873 Information disclosure in n/a High 7.5

All Sqlite Sqlite vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-9936, GHSA-pr9h-5886-9mvw, UBUNTU-CVE-2019-9936.