Executive brief
A vulnerability in the SQLite database library's Session Extension could allow a local attacker to access sensitive information. By providing a specially crafted database change file (changeset), an attacker can cause the software to read beyond its intended memory boundaries. This could lead to the exposure of small amounts of adjacent memory or cause the application to crash.
Technical details
An out-of-bounds read (CWE-126) exists in the SQLite Session Extension during the processing of malformed changeset blobs. The vulnerability is located in the changeset concat/changegroup merge path, specifically affecting functions such as sqlite3changeset_concat() and sqlite3changegroup_add(). A truncated high-bit TEXT varint in a malicious changeset can cause sqlite3GetVarint() to read past the logical buffer boundary. While the disclosure is limited to a few bytes of adjacent memory, it can lead to information leakage or application crashes (denial of service). The issue was fixed in Fossil check-in 869a51ae84df.
Affected products
- SQLite SQLite Before Fossil check-in 869a51ae84df (including 3.53.1)
Timeline
- 2026-05-21: patched: Fix committed to SQLite trunk (check-in 869a51ae84df)
- 2026-07-08: disclosed: CVE-2026-50813 published