Executive brief
SQLite's optional SQLAR archive extension contains a heap buffer overflow vulnerability in its decompression function. An attacker who can invoke the sqlar_uncompress() function with malicious input can trigger out-of-bounds memory writes, causing the application to crash. This affects custom SQLite builds compiled from source snapshots between March and April 2026.
Technical details
The vulnerability is a heap buffer overflow in sqlarUncompressFunc() within ext/misc/sqlar.c of the optional SQLAR extension. The vulnerable code reads a 64-bit size value from user input but passes it to sqlite3_malloc(int), which on LP64 systems truncates the value to 32 bits. However, the full 64-bit value is passed to zlib's uncompress() function, allowing zlib to write far beyond the allocated buffer. An attacker who can invoke sqlar_uncompress() with a controlled blob and size parameter can trigger an out-of-bounds write. The vulnerability was introduced on 2026-03-11 and fixed on 2026-04-01 by changing the allocation to sqlite3_malloc64(). The fix is present in official SQLite 3.53.0 released 2026-04-09, but affects custom source builds and development snapshots in the vulnerable window. No code execution has been demonstrated; impact is denial of service via process crash.
Affected products
- SQLite SQLite source snapshots/builds from commit 169f68e (2026-03-11) through parent of commit 34e139d (2026-04-01); official releases before 3.53.0 or 3.53.0 and later
Timeline
- 2026-03-11: other: Vulnerability introduced by Git commit 169f68ed88b34cb68f720191c64c058f2ccec508
- 2026-04-01: patched: Vulnerability fixed by Git commit 34e139d, changing allocation to sqlite3_malloc64()
- 2026-08-25: disclosed: CVE-2026-39113 published