CVE-2026-39113

Deferred Deferred - Pending Action

Buffer Overflow in SQLite Source Snapshots

Publication date: 2026-08-25

Last updated on: 2026-09-09

Assigner: MITRE

Description

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-39113

Affected Vendors & Products

Vendor	Product	Version / Range
sqlite	sqlite	From 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a Buffer Overflow vulnerability in SQLite versions after Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (March 11, 2026). It allows an attacker to cause a denial of service by exploiting issues in ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), and uncompress() functions.

Detection Guidance

This vulnerability is specific to SQLite builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d or later. Detection requires checking SQLite version and build metadata. No direct commands are provided in the context.

Impact Analysis

The vulnerability can cause a denial of service, meaning affected systems may crash or become unresponsive. This could disrupt services relying on SQLite databases, leading to downtime or loss of functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it is a denial-of-service issue in SQLite. However, denial-of-service conditions could indirectly impact systems handling sensitive data by disrupting availability, which may violate availability requirements in regulations like GDPR (Article 32) or HIPAA (Security Rule).

Mitigation Strategies

Update SQLite to a patched version that addresses the buffer overflow issue in ext/misc/sqlar.c and related components.

Hi! I’m here to help you understand CVE-2026-39113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70