UBUNTU-CVE-2026-119379: Buffer Overflow
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changesetapply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.54.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using SQLite before 3.54.0 are affected only if SQLite was built with the session extension and the application processes changesets through sqlite3changeset_apply().
What does an attacker need to exploit the vulnerability?
An attacker needs to supply a crafted changeset to sqlite3changeset_apply(). Exploitation relies on repeating a table name in a second changeset block while specifying a larger column count.
Is a default SQLite installation necessarily affected?
No. The vulnerability requires the session extension to be included in the SQLite build and requires use of the changeset-application API; the provided information does not establish that these conditions are present by default.
What can be done if upgrading is not immediately possible?
Do not accept or apply untrusted changesets with sqlite3changeset_apply(). Restrict changeset input to trusted sources and avoid processing changesets that contain repeated table names across blocks.