SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
CVE-2026-119379
CVSS base score
7.8 (v3.1)
Severity
HIGH
Attack vector
Local
Weakness
CWE-787
Last modified
November 3, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
sqlite sqlite
References
- abraxaslabs.tech Exploit, Third Party Advisory
- github.com Product
- github.com Product
- github.com Patch
- sqlite.org Issue Tracking, Patch, Vendor Advisory
- sqlite.org Release Notes
- sqlite.org Patch
- www.vulncheck.com Third Party Advisory