Skip to main content

SQLite CVE-2026-50813

MEDIUM
Buffer Over-read (CWE-126)
2026-07-08 mitre
Buffer Overflow Red Hat N A Suse
6.1
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vuln.today AI
6.1 MEDIUM

Local vector with no privileges but required user interaction to process malicious changeset; high availability from likely crash, low confidentiality from bounded heap leak.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Red Hat
MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jul 08, 2026 - 17:53 vuln.today

DescriptionCVE.org

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

AnalysisAI

Session Extension information disclosure in SQLite before Fossil check-in 869a51ae84df exposes sensitive process memory when adversarially crafted changesets are processed through the changeset concat or changegroup merge code paths. A local attacker who can deliver a malicious changeset to an application using the Session Extension API can leak heap memory contents and likely crash the process, yielding both low confidentiality and high availability impact consistent with an out-of-bounds read pattern. No active exploitation has been confirmed by CISA KEV, though a researcher gist is referenced that may represent proof-of-concept material; no public exploit is independently confirmed at time of analysis.

Technical ContextAI

SQLite's Session Extension (enabled at compile time via SQLITE_ENABLE_SESSION) provides change-tracking functionality, serializing row-level database modifications into binary 'changeset' streams. The vulnerable code paths are sqlite3changeset_concat - which merges two changeset streams - and sqlite3changegroup_add, which aggregates multiple changesets into a changegroup. A malformed or adversarially constructed changeset binary, when processed through these merge paths, triggers improper memory handling, likely an out-of-bounds read (consistent with CWE-125, though CWE is listed N/A by the reporter). This causes the library to read beyond the bounds of an allocated buffer, leaking heap contents and potentially terminating the host process. The CPE data provided (cpe:2.3:a:n/a:n/a:*) is a wildcard placeholder offering no product version range; affected versions are bounded by the upstream Fossil check-in 869a51ae84df and GitHub commit c597ed79d1bd03f57198d10d1f431adda293cf2e. The Session Extension is not active in all SQLite deployments - it must be explicitly enabled at build time or runtime - which materially narrows the affected surface.

RemediationAI

Upgrade SQLite by incorporating Fossil check-in 869a51ae84df or later, corresponding to GitHub commit c597ed79d1bd03f57198d10d1f431adda293cf2e. No specific tagged release version is confirmed as containing this fix in the available data - the patch is currently traceable only to the upstream commit; consult the SQLite changelog at https://sqlite.org/src/info/869a51ae84df to identify the first official release incorporating it. Applications that statically link SQLite must recompile against the patched source. As an immediate compensating control where upgrading is not feasible, restrict or disable processing of externally sourced or untrusted changeset data through the Session Extension's sqlite3changeset_concat and sqlite3changegroup_add APIs - this eliminates the triggering path at the cost of disabling external changeset ingestion functionality. If the Session Extension is enabled but changeset merge operations are unused, auditing application code to confirm these API paths are unreachable from untrusted input provides additional assurance without functional trade-off.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2026-64905 HIGH
7.8
CVE-2023-0817 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-50813 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy