CVE-2026-50812
Received Received - Intake

NULL Pointer Dereference in SQLite Session Extension

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: MITRE

Description
A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-08
Generated
2026-07-09
AI Q&A
2026-07-08
EPSS Evaluated
N/A
NVD
CVE-2026-50812

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sqlite sqlite to 3.53.1 (exc)
sqlite sqlite From 3.53.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50812 is a vulnerability in the SQLite Session Extension affecting SQLite version 3.53.1 and certain trunk builds before a specific fix. It is caused by a NULL pointer dereference when the function sqlite3changeset_apply_v3() attempts to apply a malformed or corrupt changeset blob. This happens because the function reaches sqlite3_value_type() with a NULL sqlite3_value pointer, leading to a crash or denial of service.

Impact Analysis

This vulnerability can be exploited by an attacker who can supply a malformed changeset blob to cause a denial of service (DoS) condition. Specifically, the application using SQLite with the Session Extension enabled may crash or terminate unexpectedly when processing the corrupt changeset. The impact is limited to availability, meaning the attacker can disrupt service but cannot gain unauthorized access or execute arbitrary code.

Mitigation Strategies

To mitigate this vulnerability, you should update SQLite to a version that includes the fix for CVE-2026-50812.

The issue was fixed in multiple check-ins, including the commit e807d4e3798efd53 and subsequent updates to the trunk and branch-3.53.

Applying these updates will prevent the NULL pointer dereference caused by malformed changeset blobs in the SQLite Session Extension.

Compliance Impact

This vulnerability causes a denial of service (DoS) by crashing the application when a malformed changeset blob is applied. The impact is limited to availability due to process termination from a NULL pointer dereference.

There is no information provided about any direct impact on confidentiality, integrity, or data protection that would affect compliance with standards such as GDPR or HIPAA.

Therefore, based on the available information, this vulnerability primarily affects system availability and does not explicitly indicate a compliance risk with common data protection regulations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart