SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://sqlite.org/src/info/f9b4ee369557c36c patch
- https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.8 · sqliteNVD modified 2026-10-30 11:30
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 8
- https://sqlite.org/bugs/info/2026-08-17T15:54:41Z issue-tracking
- https://sqlite.org/src/info/f9b4ee369557c36c patch
- https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672 technical-description
- https://sqlite.org/releaselog/3_54_0.html release-notes
- https://abraxaslabs.tech/research/sqlite-wal-pagesize third-party-advisory
- https://github.com/sqlite/sqlite product
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch third-party-advisory