CVE-2026-119379 — Vulnerability intelligence

sqlite — sqlite

Published: 2026-10-30T12:16:36.967

CVSS

8.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

Sources

• CVE-2026-119379
• Exploit, Third Party Advisory
• Product
• Product
• Patch
• Issue Tracking, Patch, Vendor Advisory
• Release Notes
• Patch
• Third Party Advisory