CVE-2026-119379

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119379", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T00:57:06.710Z", "datePublished": "2026-10-30T11:30:43.335Z", "dateUpdated": "2026-10-30T16:02:09.331Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:43.335Z"}, "datePublic": "2026-08-16T00:00:00.000Z", "title": "SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()", "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "SQLite", "product": "SQLite", "collectionURL": "https://sqlite.org/", "repo": "https://github.com/sqlite/sqlite", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThan": "3.54.0"}], "platforms": ["All platforms where SQLITE_ENABLE_SESSION is defined"]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.54.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z", "tags": ["issue-tracking"]}, {"url": "https://sqlite.org/src/info/3f57024aecea0f3b", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619", "tags": ["technical-description"]}, {"url": "https://sqlite.org/releaselog/3_54_0.html", "tags": ["release-notes"]}, {"url": "https://abraxaslabs.tech/research/sqlite-session-ncol", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sqlite/sqlite", "tags": ["product"]}, {"name": "VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"}], "credits": [{"lang": "en", "value": "Marc Heuse", "type": "finder"}, {"lang": "en", "value": "Abraxas Labs", "type": "reporter"}, {"lang": "en", "value": "Dan Kennedy", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T15:54:31.625606Z", "id": "CVE-2026-119379", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:02:09.331Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119379", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T15:54:31.625606Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:02:02.417Z"}}], "cna": {"title": "SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()", "credits": [{"lang": "en", "type": "finder", "value": "Marc Heuse"}, {"lang": "en", "type": "reporter", "value": "Abraxas Labs"}, {"lang": "en", "type": "remediation developer", "value": "Dan Kennedy"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/sqlite/sqlite", "vendor": "SQLite", "product": "SQLite", "versions": [{"status": "affected", "version": "0", "lessThan": "3.54.0", "versionType": "custom"}], "platforms": ["All platforms where SQLITE_ENABLE_SESSION is defined"], "collectionURL": "https://sqlite.org/", "defaultStatus": "unaffected"}], "datePublic": "2026-08-16T00:00:00.000Z", "references": [{"url": "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z", "tags": ["issue-tracking"]}, {"url": "https://sqlite.org/src/info/3f57024aecea0f3b", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619", "tags": ["technical-description"]}, {"url": "https://sqlite.org/releaselog/3_54_0.html", "tags": ["release-notes"]}, {"url": "https://abraxaslabs.tech/research/sqlite-session-ncol", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sqlite/sqlite", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind", "name": "VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.54.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:43.335Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119379", "state": "PUBLISHED", "dateUpdated": "2026-10-30T16:02:09.331Z", "dateReserved": "2026-10-30T00:57:06.710Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T11:30:43.335Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://sqlite.org/", "defaultStatus": "unaffected", "platforms": ["All platforms where SQLITE_ENABLE_SESSION is defined"], "product": "SQLite", "repo": "https://github.com/sqlite/sqlite", "vendor": "SQLite", "versions": [{"lessThan": "3.54.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D7328A9-932D-4FD4-8F44-90B87CAA8C4A", "versionEndExcluding": "3.54.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}], "id": "CVE-2026-119379", "lastModified": "2026-11-03T15:38:24.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119379", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T15:54:31.625606Z", "version": "2.0.3"}}]}, "published": "2026-10-30T12:16:36.967", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://abraxaslabs.tech/research/sqlite-session-ncol"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/sqlite/sqlite"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z"}, {"source": "disclosure@vulncheck.com", "tags": ["Release Notes"], "url": "https://sqlite.org/releaselog/3_54_0.html"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://sqlite.org/src/info/3f57024aecea0f3b"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sqlite: sqlite: Arbitrary code execution via crafted session changesets", "id": "2563955", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563955"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.", "A flaw was found in SQLite's session extension. A local attacker can supply a specially crafted changeset containing inconsistent table definitions, causing the application to write data past allocated memory boundaries. This heap-based buffer overflow results in memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS)."], "name": "CVE-2026-119379", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mingw-sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rust-toolset:rhel8/rust", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "nodejs:26/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-30T11:30:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119379\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119379\nhttps://abraxaslabs.tech/research/sqlite-session-ncol\nhttps://github.com/sqlite/sqlite\nhttps://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619\nhttps://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52\nhttps://sqlite.org/bugs/info/2026-08-16T10:15:25Z\nhttps://sqlite.org/releaselog/3_54_0.html\nhttps://sqlite.org/src/info/3f57024aecea0f3b\nhttps://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"], "statement": "This vulnerability is rated Important rather than Critical because successful exploitation requires an application utilizing the SQLite session module to ingest and process an untrusted, maliciously constructed changeset. While SQLite is pervasive across Red Hat Enterprise Linux, standard deployments rarely expose session synchronization interfaces directly to untrusted users. In environments where client applications or services accept external session changes, an attacker could trigger heap corruption, leading to application crashes or arbitrary code execution within the privileges of the affected process.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": ["all_platforms_where_sqlite_enable_session_is_defined"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.54.0)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "SQLite", "source": "cna", "vendor": "SQLite"}, "product": "sqlite", "vendor": "sqlite"}], "created": "2026-10-30T12:30:14.124154+00:00", "updated": "2026-10-30T13:00:14.289996+00:00", "vendors": ["sqlite", "sqlite$PRODUCT$sqlite"]}