CVE-2019-9937 Null dereference in n/a

What is CVE-2019-9937?

CVE-2019-9937 is a high-severity vulnerability in Sqlite Sqlite, published on 22 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.

Weakness: CWE-476

Which versions are affected by CVE-2019-9937?

It affects 1 product.

Products include Sqlite Sqlite.

How do I fix CVE-2019-9937?

Upgrade to a fixed version.

Is CVE-2019-9937 being exploited?

There is no known exploitation of CVE-2019-9937 in the wild and no public exploit code.

Other vulnerabilities in Sqlite Sqlite

• CVE-2015-5895 Other in n/a Critical 10.0
• CVE-2017-10989 Memory corruption in n/a Critical 9.8
• CVE-2026-11822 SQLite before 3.53.2 Memory Corruption in FTS5 Extension High 8.5
• CVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate High 8.5
• CVE-2025-70873 Information disclosure in n/a High 7.5

All Sqlite Sqlite vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-9937, GHSA-q3jg-32q5-fgj2, UBUNTU-CVE-2019-9937.