Medium severity · published Oct 30, 2026
CVE-2026-119375
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
New
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
SQLite · SQLite
before 3.54.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119375
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119375
issue-tracking
https://sqlite.org/bugs/info/2026-08-17T15:54:41Z
patch
https://sqlite.org/src/info/f9b4ee369557c36c
patch
https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e
technical-description
https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672
release-notes
https://sqlite.org/releaselog/3_54_0.html
third-party-advisory
https://abraxaslabs.tech/research/sqlite-wal-pagesize
More from SQLite
9.8
CVE-2025-3277
An integer overflow can be triggered in SQLite’s `concat_ws()` function
9.8
CVE-2020-35527
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause
9.8
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement
9.8
CVE-2019-19646
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns
9.8
CVE-2019-19317
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly…