NULL Pointer Dereference in SQLite Session Extension
CVE-2026-50812

5.5MEDIUM

Key Information:

Vendor

SQLite

Status
SQLite
Vendor
CVE Published:
8 July 2026

What is CVE-2026-50812?

A NULL pointer dereference issue exists in the SQLite Session Extension, specifically in version 3.53.1 and earlier trunk builds. An attacker could exploit this vulnerability by supplying a malformed changeset blob, causing the sqlite3changeset_apply_v3() function to attempt to process a corrupt changeset. This leads to a crash as the function reaches sqlite3_value_type() with a NULL sqlite3_value pointer, which can result in a denial of service for applications utilizing this database engine.

References

https://sqlite.org/src/info/e807d4e3798efd53
https://github.com/sqlite/sqlite/commit/b869ed6b067d623cb...
https://gist.github.com/junius-sec/bb556f333957c5226dede3...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.