CVE-2017-10989: Sqlite

Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days.

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.

Affected products

• Sqlite Sqlite: up to and including 3.19.3

Published 2017-07-07. Last modified 2026-06-17.