CVE-2026-85698: Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service
Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic when querying, causing denial of service in any application that opens untrusted database files.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using affected Turso versions are exposed when they open and query database files from untrusted sources. The vulnerability can cause an index-out-of-bounds panic, disrupting availability.
What does an attacker need to exploit it?
An attacker needs to provide a malicious database file whose table-leaf page cell-count field has been modified. Exploitation occurs when the application queries that file; no privileges are required, but user interaction is required to open or process the attacker-supplied database.
What can be done if updating is not immediately possible?
Do not open or query database files from untrusted sources. Restrict database-file ingestion to trusted, validated inputs until an update is available.