Summary
It was discovered that SQLite did not properly handle NULL pointer
dereferences in the Session Extension when applying a corrupt changeset.
An attacker could possibly use this issue to cause SQLite to crash,
resulting in a denial of service. (CVE-2026-50812)
It was discovered that SQLite had a buffer overread in the Session
Extension when processing a corrupt changeset. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2026-50813)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | sqlite3 | 3.37.2-2ubuntu0.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | sqlite3 | 3.45.1-1ubuntu2.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | sqlite3 | 3.46.1-9ubuntu0.2 |
Vulnerabilities 2
-
Medium 6.1
An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the …
-
Medium 5.5
A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e80…