SQLite CVE-2026-50813

Exploitation requires three specific conditions to be met simultaneously: (1) the target SQLite build must have the Session Extension enabled (compiled with SQLITE_ENABLE_SESSION or equivalent); (2) the target application must invoke the changeset concat (sqlite3changeset_concat) or changegroup merge (sqlite3changegroup_add) API; and (3) the attacker must be able to supply or influence the changeset data processed by those APIs - a local-access requirement per CVSS AV:L. The UI:R metric indicates user interaction is required, likely meaning a user or automated process must explicitly trigger the changeset processing operation (e.g., initiating a sync or opening a changeset file). Per CVSS PR:N, no privilege elevation is required to trigger the bug once local access to deliver the malicious changeset is achieved. What limits exploitation: applications using SQLite only for standard read/write operations without the Session Extension are not affected; the attack surface is restricted to sync, replication, or change-tracking workflows that ingest external changeset data.

The CVSS 3.1 score of 6.1 Medium reflects a local attack vector (AV:L), low confidentiality impact (C:L), no integrity impact (I:N), and high availability impact (A:H) - the last metric is higher than expected for pure information disclosure and strongly suggests the underlying bug can crash the host process in addition to leaking memory. The PR:N metric alongside AV:L and UI:R describes a scenario where no local privilege elevation is needed but the victim process or user must actively process the malicious changeset, such as opening or importing a changeset file. No EPSS data was provided; given the Session Extension's narrower deployment surface compared to core SQLite, real-world exploitation probability is likely low to moderate even within affected environments. There is no CISA KEV listing, meaning no confirmed active exploitation. A GitHub gist by researcher 'junius-sec' is referenced and may represent proof-of-concept material, but its status as a functional exploit is not independently confirmed - it should be treated as a signal rather than confirmation. The A:H impact elevates practical priority for applications using Session Extension in sync, replication, or collaborative editing workflows, where process crashes have operational consequences. The gap between 'ubiquitous SQLite deployment' and 'narrower Session Extension usage' is the key risk calibration: most SQLite consumers are not affected.

A local attacker crafts a malformed SQLite changeset binary and places it on the local filesystem or injects it into a data pipeline consumed by a target application that uses the Session Extension for sync or replication. When the application calls sqlite3changeset_concat or sqlite3changegroup_add on the malicious input, the parser reads beyond an allocated buffer boundary, leaking heap memory that may contain sensitive data such as database row contents, session tokens, or cryptographic material. A researcher gist is referenced in the CVE record, suggesting proof-of-concept material exists, though functional exploit status is not confirmed.