CVE-2020-13871: debian debian_linux Use After Free

CVSS: 7.5v3.1HighModified

AliasesDEBIAN-CVE-2020-13871

Published 06-06-2020Last modified 14-10-2026

Vulnerability summary

CVE-2020-13871 is a high (CVSS 7.5) Use After Free vulnerability in debian debian_linux. EPSS estimates a 4.45% chance of exploitation in the next 30 days, higher than 91.2% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

41/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

4.45%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 3 · Related 1

DLA-2340-1 MGASA-2021-0303 OPENSUSE-SU-2024:11400-1

Timeline

06-06-2020
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

4.45%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.45% on 18-09-2026

18-09-202618-10-2026

EPSS score

4.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (sqlite.org)
Maturity: unknown
referenceUnverified
Exploit Reference (sqlite.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Oracle6 products

communications_messaging_server8.1
communications_network_charging_and_control6.0.1 | 12.0.2
enterprise_manager_ops_center12.4.0.0
hyperion_infrastructure_technology11.1.2.4
mysql_workbench≤ 8.0.22

Show all 6

Debian2 products

sqlite3< 3.32.2-2
debian_linuxEOL9.0

Netapp2 products

Fedoraproject1 product

fedoraEOL33

Siemens1 product

sinec_infrastructure_network_services< 1.0.1.1

Sqlite1 product

sqlite3.32.2

6 vendors · 13 products

References

13 links

security.gentoo.org/glsa/202007-26Vendor AdvisoryX Refsource GENTOOMitigationThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.debian.org/debian-lts-announce/2020/08/msg00037.htmlMailing ListX Refsource MLISTThird Party Advisory
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISCThird Party Advisory
www.sqlite.org/src/info/cd708fa84d2aaaeaX Refsource MISCExploitVendor Advisory
www.sqlite.org/src/info/c8d3b9f0a750a529X Refsource MISCExploitVendor Advisory
www.sqlite.org/src/info/79eff1d0383179c4X Refsource MISCPatchVendor Advisory
security.netapp.com/advisory/ntap-20200619-0002/X Refsource CONFIRMThird Party Advisory
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfX Refsource CONFIRMPatchThird Party Advisory

Show all 13 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities