CVE-2026-119375: falha de média gravidade em SQLite
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
SQLite · SQLiteCVEs relacionadas — SQLite
No mesmo produto, das mais perigosas para as menos.
CVE-2025-6965HIGHInteger Truncation on SQLiteEPSS 73.5%CVE-2026-119586HIGHSQLite CLI through 3.54.1 Command Injection via .recover OutputEPSS 1.5%CVE-2025-29087LOWCVE-2025-29087EPSS 0.5%CVE-2025-7458MEDIUMSQLite integer overflow in key info allocation may lead to information disclosure.EPSS 0.4%CVE-2026-119379HIGHSQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()EPSS 0.3%CVE-2026-119378MEDIUMSQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()EPSS 0.3%
Referências
https://abraxaslabs.tech/research/sqlite-wal-pagesizehttps://github.com/sqlite/sqlitehttps://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166ehttps://sqlite.org/bugs/info/2026-08-17T15:54:41Zhttps://sqlite.org/releaselog/3_54_0.htmlhttps://sqlite.org/src/info/f9b4ee369557c36chttps://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch