AZL-111787: CVE-2026-119379 affecting package sqlite 3.44.0-4

Q: Which deployments are exposed?

Deployments using SQLite before 3.54.0 are affected only if SQLite was built with the session extension. The listed affected package is azure-linux/sqlite 3.44.0-4.

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to supply a crafted changeset that is processed through sqlite3changeset_apply(). The exploit uses a repeated table name in a second changeset block with a larger column count.

Q: What is the practical impact of processing a malicious changeset?

Processing the crafted changeset can cause sqlite3changeset_apply() to write past the allocated aUpdateMask buffer, corrupting heap memory.

Published Oct 30, 2026

Updated

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changesetapply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

Affected Software

1 affected component

azure-linux/sqlite<=3.44.0-4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade sqlite to a version that resolves this vulnerability.
Fixed in 3.54.0

Event History

Oct 30, 2026

Advisory Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119379

Frequently Asked Questions

Which deployments are exposed?

Deployments using SQLite before 3.54.0 are affected only if SQLite was built with the session extension. The listed affected package is azure-linux/sqlite 3.44.0-4.

What does an attacker need to exploit this issue?

An attacker needs to be able to supply a crafted changeset that is processed through sqlite3changeset_apply(). The exploit uses a repeated table name in a second changeset block with a larger column count.

What is the practical impact of processing a malicious changeset?

Processing the crafted changeset can cause sqlite3changeset_apply() to write past the allocated aUpdateMask buffer, corrupting heap memory.

AZL-111787: CVE-2026-119379 affecting package sqlite 3.44.0-4

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact of processing a malicious changeset?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact of processing a malicious changeset?