CVE-2026-50812

A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users.

This flaw affects SQLite's optional Session Extension, which provides changeset-based change tracking and is not enabled in all SQLite builds. When an application applies a malformed changeset with sqlite3changeset_apply_v3() (or the related sqlite3changeset_apply() functions), a corrupt entry can cause the function to reach an internal value pointer that has not been set, resulting in a crash. Only applications that build SQLite with the Session Extension enabled and that apply changesets from untrusted sources are affected. A fixed release of SQLite (3.53.2 and later) is available upstream.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications that use the SQLite Session Extension should only apply changesets received from trusted, authenticated sources, and should validate changeset input before passing it to sqlite3changeset_apply() or sqlite3changeset_apply_v3(). Where practical, rebuild SQLite with a version that includes the upstream fix (3.53.2 or later).