CVE-2026-119375 — Vulnerability intelligence
sqlite — sqlite
Published:
- CVSS
- 6.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.