EUVD-2026-113786
GHSA-72w2-rjgg-q729
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious database and undersized-pagesize WAL file
-
DeliveryDeliver file to victim application
-
ExploitVictim opens database and issues query
-
Executionsubstr() reads uninitialized WAL page memory
-
ImpactDisclose stale table rows and internal pointers
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied SQLite database accompanied by a crafted WAL file whose WAL-frame page size is smaller than the database page size (AV:L, UI:P in the supplied CVSS 4.0 vector). The application must use WAL journaling mode and execute a query (e.g. substr()) whose record payload exceeds the WAL page size, which causes sqlite3WalReadFrame to return uninitialized bytes. Limiting factors that reduce real-world risk: there is no remote network vector - the malicious file must reach and be opened locally by the victim; impact is confidentiality-only (VC:H, VI:N, VA:N); and applications that never open untrusted database/WAL files are not exposed. No authentication is required of the attacker (PR:N), but the user-interaction prerequisite is the primary gate. |
| Impact | This is a genuinely medium-tier issue, not a high-CVSS-but-low-risk inflation nor a drop-everything emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VC:H with VI:N/VA:N) describes a local, confidentiality-only information-disclosure flaw that requires the victim to act on attacker-supplied input - it is not a remotely reachable network bug despite PR:N. The signals are internally consistent: low attack vector plus required user interaction (opening a crafted database) explain the moderate 6.8 base score, and the impact is bounded to disclosure of uninitialized page-cache memory. No EPSS score was provided, so exploitation probability cannot be quantified from this data. The CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. A public research write-up (abraxaslabs) and a VulnCheck advisory are referenced, which lowers the barrier to building an exploit, but these are references rather than confirmed working exploit code. The vuln.today decision label is 'this_month' (prioritized remediation, not emergency), which aligns with a patchable, non-actively-exploited memory-disclosure bug in a ubiquitous library whose practical exploitation is gated by the local/user-interaction requirement. |
| Exploit ScenarioDerived | An attacker crafts a SQLite database together with a companion WAL file whose declared WAL page size is smaller than the database page size. When a victim application opens this database in WAL journaling mode and runs a query such as substr() over an oversized record payload, sqlite3WalReadFrame reads past the initialized portion of the page and returns stale uninitialized memory, leaking other table rows and internal pointers. A public research reference describes the WAL page-size-mismatch technique, though it is not verified as a working drop-in exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
An information disclosure flaw in SQLite before 3.54.0 lets an attacker who supplies a crafted database plus WAL file read uninitialized page-cache memory. When the WAL frame page size is smaller than the database page size, sqlite3WalReadFrame copies fewer bytes than requested without zeroing the remainder, so queries with oversized record payloads (for example substr()) can return stale bytes from other table rows and internal pointers. Exploitation is local and user-driven: the victim must open the attacker-supplied database and WAL pair in an application using WAL journaling and then issue such a query. No public exploit code has been identified at time of analysis, and the issue is rated medium tier with confidentiality-only impact; the vendor-released fix is SQLite 3.54.0.
RemediationAI
Upgrade to SQLite 3.54.0 or later, which contains the vendor-released patch; the exact fix is commit e5bf119821f25be1d7f10ef0a2edbe175289166e (source check-in https://sqlite.org/src/info/f9b4ee369557c36c), which zero-fills the remainder of the page buffer in sqlite3WalReadFrame. Because SQLite is commonly statically linked, rebuilding and redistributing every application and language binding that bundles SQLite below 3.54.0 is required, not just replacing a system library. Where an immediate upgrade is not possible, the practical exposure reduction is to avoid opening database files and their accompanying -wal files from untrusted or attacker-supplied sources, and to avoid WAL journaling for databases whose files cross a trust boundary; the trade-off is loss of WAL's concurrency benefits (readers no longer proceed concurrently with a writer) and, for shared or downloaded database files, loss of functionality. Vendor and third-party detail is available in the release notes at https://sqlite.org/releaselog/3_54_0.html, the bug thread at https://sqlite.org/bugs/info/2026-08-17T15:54:41Z, and the VulnCheck advisory at https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch. No public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SQLite's write-ahead log stores committed pages as frames appended to a separate WAL file, and readers reconstruct database pages through sqlite3WalReadFrame in src/wal.c. The root cause is CWE-908 (use of uninitialized resource): the frame read path trusted the WAL-declared page size, and when that value was smaller than the caller's requested length, only the short read was performed and the trailing bytes of the destination buffer were left untouched. The upstream fix (commit e5bf119821f25be1d7f10ef0a2edbe175289166e, source check-in f9b4ee369557c36c) explicitly memsets the remainder of the output buffer to zero and clamps nOut before calling sqlite3OsRead, so the fix note reads that the page read from a WAL file where WAL pagesize and database pagesize disagree is now fully initialized. Because the disclosed bytes come from page-cache memory outside the attacker's own data, they can contain fragments of unrelated table rows and internal pointers, making this a memory-disclosure primitive rather than a corruption or execution primitive. The CVSS 4.0 vector places the attack locally (AV:L) with user interaction (UI:P) and high confidentiality impact only (VC:H, VI:N, VA:N), and our assessment maps this to CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Know when Sqlite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Attacker needs the victim to open a crafted local database/WAL file (AV:L, UI:R) with no privileges (PR:N); only uninitialized memory is disclosed, so C:H, I:N, A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when hand
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles u
Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggr
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Rated high se
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing t
Memory corruption in SQLite versions before 3.53.2 enables attackers to crash processes, exhaust memory, or potentially
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo functi
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
Exploit-DB