CVE-2026-119375: fallo de gravedad media en SQLite
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 0.2%
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
SQLite · SQLiteCVEs relacionadas — SQLite
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-6965HIGHInteger Truncation on SQLiteEPSS 73.5%CVE-2026-119586HIGHSQLite CLI through 3.54.1 Command Injection via .recover OutputEPSS 1.5%CVE-2025-29087LOWCVE-2025-29087EPSS 0.5%CVE-2025-7458MEDIUMSQLite integer overflow in key info allocation may lead to information disclosure.EPSS 0.4%CVE-2026-119379HIGHSQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()EPSS 0.3%CVE-2026-119378MEDIUMSQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()EPSS 0.3%
Referencias
https://abraxaslabs.tech/research/sqlite-wal-pagesizehttps://github.com/sqlite/sqlitehttps://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166ehttps://sqlite.org/bugs/info/2026-08-17T15:54:41Zhttps://sqlite.org/releaselog/3_54_0.htmlhttps://sqlite.org/src/info/f9b4ee369557c36chttps://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch