{"uuid": "afb69a80-2720-445a-88ab-a2a17f8dc061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-MWM8-39RW-8826", "type": "seen", "source": "https://gist.github.com/alon710/4a5c4429301f5b376a75cee8d0fc3d2a", "content": "# GHSA-MWM8-39RW-8826: GHSA-MWM8-39RW-8826: Use-After-Free Vulnerability in Ruby sqlite3 Gem native extension\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/GHSA-MWM8-39RW-8826\n\n## Summary\nA Use-After-Free (UAF) vulnerability exists in the sqlite3-ruby native C extension when marshaling arguments for user-defined SQLite aggregate functions with multiple arguments. Due to temporary heap-allocated argument arrays not being registered with the Ruby Garbage Collector, active objects can be prematurely reclaimed, resulting in memory corruption or process-level crashes.\n\n## TL;DR\nA Use-After-Free flaw in the sqlite3-ruby native extension allows arbitrary memory corruption or application crash (SIGSEGV) when executing custom SQLite aggregates with multiple arguments under high memory allocation rates.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416\n- **Attack Vector**: Local / Remote (depending on application exposure)\n- **CVSS Score**: 8.1\n- **Exploit Status**: PoC available in test suite\n- **Impact**: Memory Corruption / Denial of Service / Code Execution\n- **Affected Function**: rb_sqlite3_aggregator_step\n- **Remediation**: Upgrade to sqlite3 >= 2.9.6\n\n## Affected Systems\n\n- Applications using sqlite3-ruby native gem extensions running custom multi-argument aggregate functions.\n- **sqlite3 (Ruby gem)**: < 2.9.6 (Fixed in: `2.9.6`)\n\n## Mitigation\n\n- Upgrade the sqlite3 gem dependency to version 2.9.6 or later.\n- Avoid registering multi-argument custom SQLite aggregate functions in vulnerable environments.\n- Refactor multi-argument aggregate steps to single-argument operations by passing a concatenated or serialized string.\n\n**Remediation Steps:**\n1. Audit the project's Gemfile.lock to locate references to the 'sqlite3' gem.\n2. Update the 'sqlite3' entry in the Gemfile to: gem 'sqlite3', '>= 2.9.6'\n3. Run 'bundle update sqlite3' to apply the update.\n4. Verify the resolved version in Gemfile.lock matches 2.9.6 or higher.\n\n## References\n\n- [GHSA-MWM8-39RW-8826 Advisory Entry](https://github.com/advisories/GHSA-MWM8-39RW-8826)\n- [GitHub Pull Request #733 Fix implementation](https://github.com/sparklemotion/sqlite3-ruby/pull/733)\n- [Fix Commit cc5ac0c](https://github.com/sparklemotion/sqlite3-ruby/commit/cc5ac0cdf05af8148f4363410da0ba32508d9c97)\n- [v2.9.6 Tag Release Details](https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-MWM8-39RW-8826) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-03T05:30:30.000000Z"}