CVE-2018-20506: SQL Injection
Last updated 25 August 2025
Other sources
SQLite before 3.25.3 when the FTS3 extension is enabled encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
— Microsoft
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
— MITRE
SQLite. Multiple memory corruption issues were addressed with improved input validation.
Credit
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2019-6235
- CVE-2019-6231
- CVE-2019-6230
- CVE-2019-6224
- CVE-2019-6214
- CVE-2019-6225
- CVE-2019-6210
- CVE-2019-6205
- CVE-2019-6213
- CVE-2019-6209
- CVE-2019-6208
- CVE-2019-6218
- CVE-2018-20346
- CVE-2018-20505
- CVE-2018-20506
- CVE-2019-6227
- CVE-2019-6233
- CVE-2019-6234
- CVE-2019-6229
- CVE-2019-6215
- CVE-2019-6212
- CVE-2019-6216
- CVE-2019-6217
- CVE-2019-6226
- CVE-2019-8570
- CVE-2019-6200
- CVE-2019-6202
- CVE-2019-6221
- CVE-2018-4467
- CVE-2018-4452
- CVE-2019-6219
- CVE-2019-6220
- CVE-2019-6211
- CVE-2019-6206
- CVE-2019-6228
Frequently Asked Questions
What is CVE-2018-20506?
CVE-2018-20506 is a vulnerability in SQLite that allows remote attackers to execute arbitrary code.
What is the severity of CVE-2018-20506?
The severity of CVE-2018-20506 is high with a CVSS score of 8.1.
How does CVE-2018-20506 affect SQLite?
CVE-2018-20506 affects SQLite versions prior to 3.25.3.
How can I fix CVE-2018-20506?
To fix CVE-2018-20506, update SQLite to version 3.25.3 or later.
Where can I find more information about CVE-2018-20506?
You can find more information about CVE-2018-20506 at the following references: https://security.netapp.com/advisory/ntap-20190502-0004/, http://seclists.org/fulldisclosure/2019/Jan/62, http://seclists.org/fulldisclosure/2019/Jan/64