{"id":"CVE-2019-9937","title":"In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c","summary":"In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"sqlite","product":"sqlite","affected":["sqlite = 3.27.2"],"published":"2019-03-22","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:59.130","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-9937","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/107562","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201908-09","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190416-0005/","label":"cve@mitre.org"},{"url":"https://sqlite.org/src/info/45c73deb440496e8","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4019-1/","label":"cve@mitre.org"},{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html","label":"cve@mitre.org"},{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/107562","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201908-09","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190416-0005/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://sqlite.org/src/info/45c73deb440496e8","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4019-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.06086,"epssPercentile":0.93266,"ingestedAt":"2026-10-14T07:21:04.809Z","slug":"CVE-2019-9937","body":"## Overview\n\nIn SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.\n\n## Affected\n\n- `sqlite = 3.27.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":1.2,"exploitation":0,"ransomware":0},"changes":[]}