CVE-2026-119379: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

Published Oct 30, 2026

Updated

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changesetapply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

Other sources

SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

— Microsoft

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SQLite to a version that resolves this vulnerability.
Fixed in 3.54.0

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Oct 31, 2026

Data Sourced

via Microsoft·08:05 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using SQLite versions before 3.54.0 and built with the session extension are affected. The vulnerable path is sqlite3changeset_apply().

What does an attacker need to exploit the vulnerability?

An attacker needs to supply a crafted changeset to sqlite3changeset_apply(). The changeset repeats a table name in a second block while specifying a larger column count, causing an undersized update-mask allocation to be overwritten.

Is a default SQLite build necessarily affected?

No. The affected SQLite build must include the session extension; the provided information does not establish that this extension is enabled in all default builds.

How can I determine whether my application is at risk?

Check whether it uses SQLite before 3.54.0, is built with the session extension, and applies changesets through sqlite3changeset_apply(). Applications that do not process externally supplied changesets are not described as having an attacker-controlled input path here.

CVE-2026-119379: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

Other sources

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is a default SQLite build necessarily affected?

How can I determine whether my application is at risk?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is a default SQLite build necessarily affected?

How can I determine whether my application is at risk?