CVE-2026-119375

EUVD-2026-113786
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
sqlitesqlite
𝑥
< 3.54.0
CNA
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/sqlite-wal-pagesize
https://github.com/sqlite/sqlite
https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672
https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e
https://sqlite.org/bugs/info/2026-08-17T15:54:41Z
https://sqlite.org/releaselog/3_54_0.html
https://sqlite.org/src/info/f9b4ee369557c36c
https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch