UBUNTU-CVE-2026-119375: SQL Injection
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications that open or query SQLite databases together with WAL files from untrusted sources are exposed. Exploitation requires an attacker-controlled database and WAL file to be supplied to SQLite.
What does an attacker need to do to exploit it?
The attacker must craft a WAL file with an undersized page size and an oversized record payload, then cause SQLite to query the crafted data, such as through substr(). The attack vector is local and requires user interaction, while no privileges are required.
What information could be disclosed?
Successful exploitation can return stale bytes from uninitialized page-cache memory. The disclosed data may include contents from other table rows and internal pointers.
Which SQLite versions are affected?
SQLite versions before 3.54.0 are affected.