What’s Vulnerable › Vulnerabilities

CVE-2021-36690

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-24 · updated 2026-10-14

Description

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

Affected products

• Apple Iphone Os: before 16.0 — fixed in 16.0
• Apple macOS: before 13.0 — fixed in 13.0
• Apple tvOS: before 16.0 — fixed in 16.0
• Apple watchOS: before 9.0 — fixed in 9.0
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
• SQLite: 3.36.0

How to fix

Upgrade to a fixed version: Apple Iphone Os 16.0; Apple macOS 13.0; Apple tvOS 16.0; Apple watchOS 9.0. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/39
• http://seclists.org/fulldisclosure/2022/Oct/41
• http://seclists.org/fulldisclosure/2022/Oct/47
• http://seclists.org/fulldisclosure/2022/Oct/49
• https://support.apple.com/kb/HT213446
• https://support.apple.com/kb/HT213486
• https://support.apple.com/kb/HT213487
• https://support.apple.com/kb/HT213488
• https://www.sqlite.org/forum/forumpost/718c0a8d17
• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/39

Get alerted when CVE-2021-36690 or the next vulnerability affects your stack