SQLCipher CVE-2026-51936

Exploitation requires the host application to call SQLCipher's sqlcipher_export() convenience function AND to pass an attacker-influenced value as the source database name argument; only then can a crafted source name execute statements that defensive mode would normally block. Limiting factors: the attack is local (AV:L), requires the specific and non-universal code path of exporting/converting databases via sqlcipher_export with untrusted input (AT:P), and is confined to SQLCipher versions before 4.15.0. Impact is limited to schema manipulation and database corruption (integrity/availability), not decryption or data disclosure. Applications that never expose the source-name parameter to untrusted input are not realistically exploitable.

This is a low-real-risk issue despite being a genuine SQL injection (CWE-89). The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L, score 2.1) is consistent with the description: the flaw is not a network-reachable data-exfiltration bug but a local, requirements-gated integrity/availability issue. The impact is limited to modifying the sqlite_schema table and corrupting the database (VI:L/VA:L), with no confidentiality impact (VC:N) - notable because the affected product is an ENCRYPTION library, yet this bug does not defeat encryption or leak plaintext. Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing, no EPSS score provided, and no POC - only a fix commit and a vendor release blog. The AT:P (attack requirements) in the 4.0 vector reflects the real limiting factor: an attacker must be able to feed a crafted source-database-name string into the sqlcipher_export() convenience function, which requires the host application to pass untrusted input into that specific parameter - an uncommon code pattern. No signals conflict; all sources agree this is minor. The only nuance is prevalence: SQLCipher itself is very widely embedded, so a large install base is exposed to a small-impact bug.

An application uses SQLCipher's sqlcipher_export() convenience function (e.g. to convert between plaintext and encrypted databases) and passes an externally-influenced value as the source database name. An attacker who controls that source-name string supplies a crafted value that executes statements while defensive mode is temporarily relaxed, directly modifying the sqlite_schema table and corrupting the database. No public exploit code exists; a fix commit and vendor tests demonstrate the source-name validation.