Heap Buffer Overflow in SQLite Session Extension Affects Multiple Versions

CVE-2026-119379

What is CVE-2026-119379?

A heap buffer overflow vulnerability exists in SQLite's session extension within the sqlite3changeset_apply() function. This issue permits attackers to manipulate heap memory through specially crafted changesets. By repeating a table name in a subsequent changeset block using a larger column count, attackers can exploit the sessionUpdateFind() function, which leads to a memory overwrite beyond the allocated size for aUpdateMask. This flaw is present in all versions of SQLite prior to 3.54.0.

References