CVE-2019-8457: canonical ubuntu_linux Out-of-bounds Read
Vulnerability summary
CVE-2019-8457 is a critical (CVSS 9.8) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 45.43% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities.
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 45% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 30-05-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
45.43%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 45.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse17 products
- sqlite3&distro=SUSE Enterprise Storage 4< 3.8.10.2-9.9.1
- sqlite3&distro=SUSE Linux Enterprise Desktop 12 SP3< 3.8.10.2-9.9.1
- sqlite3&distro=SUSE Linux Enterprise Desktop 12 SP4< 3.8.10.2-9.9.1
- sqlite3&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.7.6.3-1.4.7.9.1
- sqlite3&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 3.7.6.3-1.4.7.9.1
Ubuntu4 products
- db5.3< 5.3.28-3ubuntu3.1+esm1 | < 5.3.28-11ubuntu0.2 | < 5.3.28-13.1ubuntu1.1 | < 5.3.28+dfsg1-0.6ubuntu1
- qtwebengine-opensource-srcAll versions (No fix recorded)
- sqlcipherAll versions (No fix recorded)
- sqlite3< 3.8.2-1ubuntu2.2+esm1 | < 3.11.0-1ubuntu1.2 | < 3.22.0-1ubuntu0.1
Debian2 products
- db5.3< 5.3.28+dfsg1-0.9
- sqlite3< 3.27.2-3
Alpine1 product
- sqlite≥ 3.6.0, < 3.28.0-r0 | ≥ 3.6.0, < 3.25.3-r1
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10 | 19.04
Fedoraproject1 product
- fedoraEOL29 | 30
Opensuse1 product
- leapEOL42.3
Sqlite1 product
- sqlite≥ 3.6.0, ≤ 3.27.2
8 vendors · 28 products
References
29 links- lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISC
- www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISC
- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCPatchThird Party Advisory
Show all 29 references
- www.oracle.com/security-alerts/cpujan2020.htmlX Refsource MISC
- kc.mcafee.com/corporate/index?page=content&id=SB10365X Refsource CONFIRM
