Executive brief
A vulnerability exists in the SQLite Session Extension, a component used to record and apply changes to database tables. An attacker can provide a specially crafted, malformed data file (changeset) that causes the application using SQLite to crash. This results in a denial of service, potentially disrupting business operations or applications that rely on processing database updates from external sources.
Technical details
A NULL pointer dereference exists in the SQLite Session Extension within the changeset application logic. The vulnerability is triggered when the `sqlite3changeset_apply_v3()` function processes a corrupt or malformed changeset blob, eventually calling `sqlite3_value_type()` with a NULL `sqlite3_value` pointer. This occurs specifically within the `sessionBindValue()` or `sessionApplyOneOp()` paths. An attacker who can influence the changeset data processed by an application can cause a process crash (Denial of Service). The issue was addressed in SQLite trunk check-in e807d4e3798efd53 and backported to the 3.53 branch.
Affected products
- SQLite SQLite 3.53.1, trunk builds before check-in e807d4e3798efd53
Timeline
- 2026-05-20: patched: Fix committed to SQLite trunk and 3.53 branch
- 2026-07-02: disclosed: Researcher Gist published
- 2026-07-08: advisory: CVE-2026-50812 published to NVD