Junglewise Threat Intelligence

CVE-2026-50812: SQLite Session Extension NULL pointer dereference in changeset application

CVE-2026-50812 · Severity: info · CVSS 7.5 · Published 2026-07-08

Executive brief

A vulnerability exists in the SQLite Session Extension, a component used to record and apply changes to database tables. An attacker can provide a specially crafted, malformed data file (changeset) that causes the application using SQLite to crash. This results in a denial of service, potentially disrupting business operations or applications that rely on processing database updates from external sources.

Technical details

A NULL pointer dereference exists in the SQLite Session Extension within the changeset application logic. The vulnerability is triggered when the `sqlite3changeset_apply_v3()` function processes a corrupt or malformed changeset blob, eventually calling `sqlite3_value_type()` with a NULL `sqlite3_value` pointer. This occurs specifically within the `sessionBindValue()` or `sessionApplyOneOp()` paths. An attacker who can influence the changeset data processed by an application can cause a process crash (Denial of Service). The issue was addressed in SQLite trunk check-in e807d4e3798efd53 and backported to the 3.53 branch.

Affected products

  • SQLite SQLite 3.53.1, trunk builds before check-in e807d4e3798efd53

Timeline

  • 2026-05-20: patched: Fix committed to SQLite trunk and 3.53 branch
  • 2026-07-02: disclosed: Researcher Gist published
  • 2026-07-08: advisory: CVE-2026-50812 published to NVD

References