{"id":"CVE-2026-119379","published":"2026-10-30T12:16:36.967","lastModified":"2026-10-30T18:41:13.287","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://abraxaslabs.tech/research/sqlite-session-ncol","tags":[]},{"url":"https://github.com/sqlite/sqlite","tags":[]},{"url":"https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","tags":[]},{"url":"https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","tags":[]},{"url":"https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","tags":[]},{"url":"https://sqlite.org/releaselog/3_54_0.html","tags":[]},{"url":"https://sqlite.org/src/info/3f57024aecea0f3b","tags":[]},{"url":"https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind","tags":[]}],"exploitRefs":[{"url":"https://github.com/sqlite/sqlite","tags":[]},{"url":"https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","tags":[]},{"url":"https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","tags":[]}],"hasPoc":true,"ai":null}