Live › vulnerability › CVE-2026-119379
SQLite builds with the session extension before 3.54.0 have a heap buffer overflow in sqlite3changeset_apply(). A crafted changeset that repeats a table name with a larger column count makes sessionUpdateFind() write past an undersized buffer, corrupting heap memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that compile SQLite with the session extension and apply changesets, especially ones that accept changesets from outside the trust boundary. Builds without the session extension, and applications that never call sqlite3changeset_apply(), are not exposed.
No product ranges from the sources yet.
sqlite3 --version; anything below 3.54.0 is in range.SQLITE_ENABLE_SESSION, which the session extension requires.3.54.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
This page as .md · .json · in your agent: get_signal("CVE-2026-119379")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.