SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
CVE-2026-119375
CVSS base score
5.5 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-908
Last modified
November 3, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
sqlite sqlite
References
- abraxaslabs.tech Exploit, Third Party Advisory
- github.com Product
- github.com Patch
- github.com Patch
- sqlite.org Issue Tracking, Patch, Vendor Advisory
- sqlite.org Release Notes
- sqlite.org Patch, Vendor Advisory
- www.vulncheck.com Third Party Advisory