CVE-2026-50812

EUVD-2026-42501
A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.62%
Debian logo
Debian Releases
Debian Product
Codename
sqlite3
bookworm
postponed
bullseye
postponed
bullseye (security)
vulnerable
forky
3.53.4-2
fixed
sid
3.53.4-2
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sqlite
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
sqlite3
bionic
needs-triage
focal
needs-triage
jammy
Fixed 3.37.2-2ubuntu0.7
released
noble
Fixed 3.45.1-1ubuntu2.7
released
questing
ignored
resolute
Fixed 3.46.1-9ubuntu0.2
released
trusty
needs-triage
xenial
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
nodejs22
Amazon Linux 2023
1:22.23.2-1.amzn2023.0.2
fixed
nodejs22-debuginfo
Amazon Linux 2023
1:22.23.2-1.amzn2023.0.2
fixed
nodejs22-debugsource
Amazon Linux 2023
1:22.23.2-1.amzn2023.0.2
fixed
nodejs22-devel
Amazon Linux 2023
1:22.23.2-1.amzn2023.0.2
fixed
nodejs22-docs
Amazon Linux 2023
1:22.23.2-1.amzn2023.0.2
fixed
nodejs22-full-i18n
Amazon Linux 2023
1:22.23.2-1.amzn2023.0.2
fixed
nodejs22-libs
Amazon Linux 2023
1:22.23.2-1.amzn2023.0.2
fixed
nodejs22-libs-debuginfo
Amazon Linux 2023
1:22.23.2-1.amzn2023.0.2
fixed
nodejs22-npm
Amazon Linux 2023
1:10.9.8-1.22.23.2.1.amzn2023.0.2
fixed
v8-12.4-devel
Amazon Linux 2023
3:12.4.254.21-1.22.23.2.1.amzn2023.0.2
fixed