Buffer Overflow Vulnerability in SQLite3 Ruby Bindings Affects Sparklemotion

CVE-2026-128084

What is CVE-2026-128084?

The SQLite3 Ruby bindings before version 2.10.2 are susceptible to a buffer overflow vulnerability caused by string length casting issues. Specifically, when handling strings of 4 GiB or more on 64-bit systems, the length can wrap, leading SQLite to process only a truncated prefix. This issue can result in incomplete SQL strings that potentially omit important clauses such as WHERE conditions. An attacker could exploit this vulnerability by injecting unusually large strings into the application, risking erroneous query execution or application errors. Developers are advised to upgrade to version 2.10.2 to mitigate this risk.

References