{"id":"CVE-2026-119379","kind":"vulnerability","aliases":["CVE-2026-119379"],"related":[],"title":"SQLite: crafted changesets overflow heap memory in session extension apply","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.","summary":"SQLite builds with the session extension before 3.54.0 have a heap buffer overflow in sqlite3changeset_apply(). A crafted changeset that repeats a table name with a larger column count makes sessionUpdateFind() write past an undersized buffer, corrupting heap memory.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","embedded-database","package","session-extension","sqlite"],"not_affected_if":["no-changeset-apply","session-extension-disabled","sqlite-3.54.0-or-later"],"how_to_check":"- Check the SQLite version with `sqlite3 --version`; anything below `3.54.0` is in range.\n- Check whether the build defines `SQLITE_ENABLE_SESSION`, which the session extension requires.\n- Check whether the application calls sqlite3changeset_apply() on changesets it does not fully trust.","fix":"- SQLite: `3.54.0` or later","status":"open","published_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","triaged_at":"2026-10-30T12:32:08+00:00","updated_at":"2026-10-30T12:32:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:32:08Z","model":"claude-haiku-5-5","output":{"fix":"- SQLite: `3.54.0` or later","reach":"unknown","title":"SQLite: crafted changesets overflow heap memory in session extension apply","impact":"high","summary":"SQLite builds with the session extension before 3.54.0 have a heap buffer overflow in sqlite3changeset_apply(). A crafted changeset that repeats a table name with a larger column count makes sessionUpdateFind() write past an undersized buffer, corrupting heap memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["sqlite","session-extension","c","embedded-database"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker corrupts heap memory, possibly enabling code execution in the host process.","analyst_note":"","how_to_check":"- Check the SQLite version with `sqlite3 --version`; anything below `3.54.0` is in range.\n- Check whether the build defines `SQLITE_ENABLE_SESSION`, which the session extension requires.\n- Check whether the application calls sqlite3changeset_apply() on changesets it does not fully trust.","plain_action":"","needs_analyst":false,"not_affected_if":["session-extension-disabled","no-changeset-apply","sqlite-3.54.0-or-later"],"who_is_affected":"Applications that compile SQLite with the session extension and apply changesets, especially ones that accept changesets from outside the trust boundary. Builds without the session extension, and applications that never call sqlite3changeset_apply(), are not exposed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001123,"input_tokens":4152,"output_tokens":1415,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119379':13A,16A '-2026':12A,15A '3.54.0':33B,67C 'alloc':117C 'allow':83C 'appli':10A,41B,81C 'attack':84C,93C 'aupdatemask':116C 'block':103C 'buffer':37B,61B,76C 'build':27B 'built':68C 'c':17B 'caus':109C 'changeset':3A,44B,92C,102C 'column':53B,107C 'contain':73C 'corrupt':62B,86C 'count':54B,108C 'craft':2A,43B,91C 'cve':11A,14A 'databas':20B 'embed':19B 'embedded-databas':18B 'extens':9A,24B,31B,72C 'heap':5A,36B,63B,75C,87C 'larger':52B,106C 'make':55B 'memori':6A,64B,88C 'memset':112C 'name':49B,98C 'overflow':4A,38B,77C 'packag':21B 'past':58B,113C 'repeat':46B,95C 'second':101C 'session':8A,23B,30B,71C 'session-extens':22B 'sessionupdatefind':56B,110C 'sqlite':1A,25B,26B,65C 'sqlite3changeset':40B,80C 'suppli':90C 'tabl':48B,97C 'unders':60B,115C 'vulner':78C 'write':57B","nicknames":[],"mitigations":[],"who_affected":"Applications that compile SQLite with the session extension and apply changesets, especially ones that accept changesets from outside the trust boundary. Builds without the session extension, and applications that never call sqlite3changeset_apply(), are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","severity":null,"published_at":"2026-10-30T12:16:36+00:00","modified_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","fetched_at":"2026-10-30T12:30:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}