Live › vulnerability › CVE-2026-119375
SQLite versions before 3.54.0 read uninitialized page-cache memory when a database comes with a WAL file that has an undersized page size. An attacker who supplies such a crafted database and WAL pair can make queries like substr() return stale bytes, exposing other table rows and internal pointers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that embed or link SQLite before 3.54.0 and open database files an attacker could supply, such as user uploads or files received from outside. Applications that only open their own trusted databases are less exposed. unknown for any exposure beyond what the description states.
No product ranges from the sources yet.
sqlite3 --version on the host or the bundled version in your language driver.3.54.0 or later, per the advisory description.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
This page as .md · .json · in your agent: get_signal("CVE-2026-119375")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.