CVE-2026-119379
Received Received - Intake

SQLite Session Extension Heap Buffer Overflow

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119379
EUVD
EUVD-2026-113790

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SQLite SQLite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119379 is a heap buffer overflow vulnerability in SQLite versions before 3.54.0. It occurs in the session extension when processing crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to write beyond the allocated aUpdateMask buffer, leading to memory corruption or crashes.

Detection Guidance

To detect this vulnerability, check the SQLite version installed on your system. Run: sqlite3 --version. If the version is below 3.54.0, the system is vulnerable. Additionally, monitor for crashes or memory corruption when processing changesets in applications using the session extension.

Impact Analysis

This vulnerability can lead to memory corruption, application crashes, or arbitrary code execution if exploited. It specifically affects applications using SQLite's session extension to process changesets from untrusted sources, potentially allowing unauthorized data modifications or disclosure.

Mitigation Strategies

Upgrade SQLite to version 3.54.0 or later immediately. If upgrading is not possible, disable the session extension in your SQLite build to prevent processing changesets from untrusted sources. Review applications using SQLite session features and apply patches from official sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart