Information Disclosure Vulnerability in SQLite by Vendor

CVE-2026-119375

What is CVE-2026-119375?

SQLite prior to version 3.54.0 has a vulnerability that may allow attackers to gain access to sensitive information through uninitialized page-cache memory. This occurs when an attacker constructs a Write-Ahead Logging (WAL) file that uses a smaller page size, resulting in corrupted queries such as substr() returning outdated data. This can potentially expose other rows from the database, including internal pointers, thus compromising data confidentiality and integrity.

References