CVE catalog

CVE-2026-39113

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 25, 2026

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansqlite3sid3.53.4-2not affected
Debiansqlite3forky3.53.4-2not affected
Debiansqlite3trixie3.46.1-7+deb13u2not affected
Debiansqlite3bookworm3.40.1-2+deb12u2not affected
Ubuntusqlite3noble3.45.1-1ubuntu2.8fixed
Ubuntulemonnoble3.45.1-1ubuntu2.8fixed
Ubuntulibsqlite3-0noble3.45.1-1ubuntu2.8fixed
Ubuntulibsqlite3-devnoble3.45.1-1ubuntu2.8fixed
Ubuntulibsqlite3-tclnoble3.45.1-1ubuntu2.8fixed
Ubuntusqlite3-docnoble3.45.1-1ubuntu2.8fixed
Ubuntusqlite3-toolsnoble3.45.1-1ubuntu2.8fixed
Ubuntusqlite3pro3.29.0-2vulnerable
Ubuntusqlite3pro3.30.1-1vulnerable
Ubuntusqlite3pro3.30.1-1ubuntu1vulnerable
Ubuntusqlite3pro3.31.1-1ubuntu1vulnerable
Ubuntusqlite3pro3.31.1-3vulnerable
Ubuntusqlite3pro3.31.1-4vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.1vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.2vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.3vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.4vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.5vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.6vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7+esm1vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7+esm2fixed
Ubuntusqlite322.043.35.5-1vulnerable
Ubuntusqlite322.043.36.0-2vulnerable
Ubuntusqlite322.043.37.2-2vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.1vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.3vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.4vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.5vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.6vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.7vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.8fixed
Ubuntusqlite324.043.42.0-1vulnerable
Ubuntusqlite324.043.44.0-1vulnerable
Ubuntusqlite324.043.44.2-1vulnerable
Ubuntusqlite324.043.45.0-1vulnerable
Ubuntusqlite324.043.45.1-1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.3vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.4vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.5vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.6vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.7vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.8fixed
Ubuntusqlite326.043.46.1-8vulnerable
Ubuntusqlite326.043.46.1-9vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.1vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.2vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.3fixed
Ubuntusqlite14.042.8.17-8fakesync1vulnerable
Ubuntusqlite14.042.8.17-9fakesync1vulnerable
Ubuntusqlite14.042.8.17-10ubuntu2vulnerable
Ubuntusqlite16.042.8.17-12fakesync1vulnerable
Ubuntusqlite3pro3.29.0-2vulnerable
Ubuntusqlite3pro3.30.1-1vulnerable
Ubuntusqlite3pro3.30.1-1ubuntu1vulnerable
Ubuntusqlite3pro3.31.1-1ubuntu1vulnerable
Ubuntusqlite3pro3.31.1-3vulnerable
Ubuntusqlite3pro3.31.1-4vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.1vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.2vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.3vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.4vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.5vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.6vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7+esm1vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7+esm2fixed
Ubuntusqlite18.042.8.17-14fakesync1vulnerable
Ubuntusqlite20.042.8.17-15fakesync1build1vulnerable
Ubuntusqlite22.042.8.17-15fakesync1build1vulnerable
Ubuntusqlite322.043.35.5-1vulnerable
Ubuntusqlite322.043.36.0-2vulnerable
Ubuntusqlite322.043.37.2-2vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.1vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.3vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.4vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.5vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.6vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.7vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.8fixed
Ubuntusqlite324.043.42.0-1vulnerable
Ubuntusqlite324.043.44.0-1vulnerable
Ubuntusqlite324.043.44.2-1vulnerable
Ubuntusqlite324.043.45.0-1vulnerable
Ubuntusqlite324.043.45.1-1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.3vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.4vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.5vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.6vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.7vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.8fixed
Ubuntusqlite326.043.46.1-8vulnerable
Ubuntusqlite326.043.46.1-9vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.1vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.2vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansqlite3sourcesidNot affectedunimportantNot reportedNot reported
Debiansqlite3sourceforkyNot affectedunimportantNot reportedNot reported
Debiansqlite3sourcetrixieNot affectedunimportantNot reportedNot reported
Debiansqlite3sourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntusqlite3debnoble3.45.1-1ubuntu2.8Not reportedNot reportedNot reported
Ubuntulemondebnoble3.45.1-1ubuntu2.8Not reportedNot reportedNot reported
Ubuntulibsqlite3-0debnoble3.45.1-1ubuntu2.8Not reportedNot reportedNot reported
Ubuntulibsqlite3-devdebnoble3.45.1-1ubuntu2.8Not reportedNot reportedNot reported
Ubuntulibsqlite3-tcldebnoble3.45.1-1ubuntu2.8Not reportedNot reportedNot reported
Ubuntusqlite3-docdebnoble3.45.1-1ubuntu2.8Not reportedNot reportedNot reported
Ubuntusqlite3-toolsdebnoble3.45.1-1ubuntu2.8Not reportedNot reportedNot reported
Ubuntusqlite3debpro3.31.1-4ubuntu0.7+esm2Not reportedUSN-8775-1Not reported
Ubuntusqlite3deb22.043.37.2-2ubuntu0.8Not reportedUSN-8775-1Not reported
Ubuntusqlite3deb24.043.45.1-1ubuntu2.8Not reportedUSN-8775-1Not reported
Ubuntusqlite3deb26.043.46.1-9ubuntu0.3Not reportedUSN-8775-1Not reported
Ubuntusqlite3debpro3.31.1-4ubuntu0.7+esm2Not reportedUBUNTU-CVE-2026-39113Not reported
Ubuntusqlite3deb22.043.37.2-2ubuntu0.8Not reportedUBUNTU-CVE-2026-39113Not reported
Ubuntusqlite3deb24.043.45.1-1ubuntu2.8Not reportedUBUNTU-CVE-2026-39113Not reported
Ubuntusqlite3deb26.043.46.1-9ubuntu0.3Not reportedUBUNTU-CVE-2026-39113Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [lemon]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-0]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-dev]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-ext-csv]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-ext-icu]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-tcl]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [sqlite3]Affected
    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [sqlite3-doc]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · all · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · all · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [sqlite3-tools]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

[Debian 12 (Bookworm)]

  • [lemon]Not affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

  • [libsqlite3-0]Not affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

  • [libsqlite3-dev]Not affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

  • [libsqlite3-tcl]Not affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

  • [sqlite3]Not affected
    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

  • [sqlite3-doc]Not affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · all · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

    • 3.40.1-2+deb12u2 · all · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

  • [sqlite3-tools]Not affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · sqlite3 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]