Medium severity · published Oct 30, 2026
CVE-2026-119375
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
New
5.5
CVSS
–
EPSS
No
On KEV
Description
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
SQLite · SQLite
before 3.54.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119375
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119375
issue-tracking
https://sqlite.org/bugs/info/2026-08-17T15:54:41Z
patch
https://sqlite.org/src/info/f9b4ee369557c36c
patch
https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e
technical-description
https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672
release-notes
https://sqlite.org/releaselog/3_54_0.html
third-party-advisory
https://abraxaslabs.tech/research/sqlite-wal-pagesize
More from SQLite
9.8
CVE-2025-3277
An integer overflow can be triggered in SQLite’s `concat_ws()` function
9.8
CVE-2020-35527
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause
9.8
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement
9.8
CVE-2019-19646
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns
9.8
CVE-2019-19317
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly…