{"id":"CVE-2026-119375","kind":"vulnerability","aliases":["CVE-2026-119375"],"related":[],"title":"SQLite: crafted WAL file leaks uninitialized page-cache memory to queries","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.","summary":"SQLite versions before 3.54.0 read uninitialized page-cache memory when a database comes with a WAL file that has an undersized page size. An attacker who supplies such a crafted database and WAL pair can make queries like substr() return stale bytes, exposing other table rows and internal pointers.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","embedded-database","node","package","python","sqlite"],"not_affected_if":["sqlite-3.54.0-or-later","trusted-database-files-only"],"how_to_check":"- Check the SQLite library version your application links against, for example `sqlite3 --version` on the host or the bundled version in your language driver.\n- Look for applications that open database files supplied by users or untrusted sources.","fix":"- SQLite `3.54.0` or later, per the advisory description.","status":"open","published_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","triaged_at":"2026-10-30T12:32:37+00:00","updated_at":"2026-10-30T12:32:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T12:32:37Z","model":"claude-haiku-5-5","output":{"fix":"- SQLite `3.54.0` or later, per the advisory description.","reach":"unknown","title":"SQLite: crafted WAL file leaks uninitialized page-cache memory to queries","impact":"medium","summary":"SQLite versions before 3.54.0 read uninitialized page-cache memory when a database comes with a WAL file that has an undersized page size. An attacker who supplies such a crafted database and WAL pair can make queries like substr() return stale bytes, exposing other table rows and internal pointers.","audience":"developers","category":"package","nicknames":[],"who_cares":["sqlite","embedded-database","c","python","node"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Stale memory leaks table rows and internal pointers to the attacker","analyst_note":"Sources list only the NVD entry; confirm the exact affected version range and whether a WAL file must be supplied locally or remotely.","how_to_check":"- Check the SQLite library version your application links against, for example `sqlite3 --version` on the host or the bundled version in your language driver.\n- Look for applications that open database files supplied by users or untrusted sources.","plain_action":"","needs_analyst":true,"not_affected_if":["sqlite-3.54.0-or-later","trusted-database-files-only"],"who_is_affected":"Applications that embed or link SQLite before 3.54.0 and open database files an attacker could supply, such as user uploads or files received from outside. Applications that only open their own trusted databases are less exposed. unknown for any exposure beyond what the description states.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4140,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119375':15A,18A '-2026':14A,17A '3.54.0':30B,79C 'allow':86C 'attack':52B,87C,105C 'byte':69B,123C 'c':19B 'cach':9A,35B,93C 'come':40B 'contain':80C 'craft':2A,57B,107C 'cve':13A,16A 'databas':22B,39B,58B,109C 'disclos':124C 'disclosur':83C 'embed':21B 'embedded-databas':20B 'expos':70B 'file':4A,44B,99C,112C 'inform':82C 'intern':75B,129C 'leak':5A 'like':65B,119C 'make':63B,117C 'memori':10A,36B,94C 'node':23B 'overs':114C 'packag':24B 'page':8A,34B,49B,92C,103C 'page-cach':7A,33B,91C 'pair':61B 'payload':116C 'pointer':76B,130C 'python':25B 'queri':12A,64B,118C 'read':31B,89C 'record':115C 'return':67B,121C 'row':73B,127C 'size':50B,104C 'sqlite':1A,26B,27B,77C 'stale':68B,122C 'substr':66B,120C 'suppli':54B,96C 'tabl':72B,126C 'unders':48B,102C 'uniniti':6A,32B,90C 'version':28B 'vulner':84C 'wal':3A,43B,60B,98C,111C 'whose':113C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed or link SQLite before 3.54.0 and open database files an attacker could supply, such as user uploads or files received from outside. Applications that only open their own trusted databases are less exposed. unknown for any exposure beyond what the description states.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","severity":null,"published_at":"2026-10-30T12:16:36+00:00","modified_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","fetched_at":"2026-10-30T12:30:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}