Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Local vector with no privileges but required user interaction to process malicious changeset; high availability from likely crash, low confidentiality from bounded heap leak.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Lifecycle Timeline
1DescriptionCVE.org
An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path
AnalysisAI
Session Extension information disclosure in SQLite before Fossil check-in 869a51ae84df exposes sensitive process memory when adversarially crafted changesets are processed through the changeset concat or changegroup merge code paths. A local attacker who can deliver a malicious changeset to an application using the Session Extension API can leak heap memory contents and likely crash the process, yielding both low confidentiality and high availability impact consistent with an out-of-bounds read pattern. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions to be met simultaneously: (1) the target SQLite build must have the Session Extension enabled (compiled with SQLITE_ENABLE_SESSION or equivalent); (2) the target application must invoke the changeset concat (sqlite3changeset_concat) or changegroup merge (sqlite3changegroup_add) API; and (3) the attacker must be able to supply or influence the changeset data processed by those APIs - a local-access requirement per CVSS AV:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.1 Medium reflects a local attack vector (AV:L), low confidentiality impact (C:L), no integrity impact (I:N), and high availability impact (A:H) - the last metric is higher than expected for pure information disclosure and strongly suggests the underlying bug can crash the host process in addition to leaking memory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker crafts a malformed SQLite changeset binary and places it on the local filesystem or injects it into a data pipeline consumed by a target application that uses the Session Extension for sync or replication. When the application calls sqlite3changeset_concat or sqlite3changegroup_add on the malicious input, the parser reads beyond an allocated buffer boundary, leaking heap memory that may contain sensitive data such as database row contents, session tokens, or cryptographic material. … |
| Remediation | Upgrade SQLite by incorporating Fossil check-in 869a51ae84df or later, corresponding to GitHub commit c597ed79d1bd03f57198d10d1f431adda293cf2e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today