Executive brief
Turso is a SQL database engine used as a SQLite-compatible backend. The vulnerability allows denial of service when opening untrusted database files: an attacker can craft a malicious database with a modified cell count field that causes the application to crash when attempting to query the database, disrupting service for any application relying on Turso.
Technical details
The vulnerability is an out-of-bounds read (bounds check bypass / CWE-125) in the table-leaf page reader of Turso's storage layer (pager.rs). The root cause is insufficient bounds validation on an attacker-controlled cell-count field read from the database file. When querying a malicious database file with an invalid cell count, the code attempts to access array indices beyond the allocated buffer, triggering a panic (index-out-of-bounds exception) and crashing the application. The attack requires only that the application opens an untrusted database file; no authentication or network access is required. A patch is likely available in versions after 0.8.0-pre.8, though specific patch details are not provided.
Affected products
- Turso Turso through 0.8.0-pre.8
Timeline
- 2026-09-04: disclosed
- other: Vulnerability reported for CVE-2026-85698