CVE catalog

CVE-2026-50812

A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cau

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 25, 2026

A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansqlite3sid3.53.4-2fixed
Debiansqlite3forky3.53.4-2fixed
Debiansqlite3trixie3.46.1-7+deb13u2vulnerable
Debiansqlite3bookworm3.40.1-2+deb12u2vulnerable
Cpesqlite3Not reportedNot reportedvulnerable
Cpesqlite3Not reported3.45.1-1ubuntu2.7fixed
CpelemonNot reported3.45.1-1ubuntu2.7fixed
Cpelibsqlite3-0Not reported3.45.1-1ubuntu2.7fixed
Cpelibsqlite3-devNot reported3.45.1-1ubuntu2.7fixed
Cpelibsqlite3-tclNot reported3.45.1-1ubuntu2.7fixed
Cpesqlite3-docNot reported3.45.1-1ubuntu2.7fixed
Cpesqlite3-toolsNot reported3.45.1-1ubuntu2.7fixed
Ubuntusqlite14.042.8.17-8fakesync1vulnerable
Ubuntusqlite14.042.8.17-9fakesync1vulnerable
Ubuntusqlite14.042.8.17-10ubuntu2vulnerable
Ubuntusqlite3pro3.29.0-2vulnerable
Ubuntusqlite3pro3.30.1-1vulnerable
Ubuntusqlite3pro3.30.1-1ubuntu1vulnerable
Ubuntusqlite3pro3.31.1-1ubuntu1vulnerable
Ubuntusqlite3pro3.31.1-3vulnerable
Ubuntusqlite3pro3.31.1-4vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.1vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.2vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.3vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.4vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.5vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.6vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7+esm1vulnerable
Ubuntusqlite3pro3.31.1-4ubuntu0.7+esm2vulnerable
Ubuntusqlite16.042.8.17-12fakesync1vulnerable
Ubuntusqlite18.042.8.17-14fakesync1vulnerable
Ubuntusqlite20.042.8.17-15fakesync1build1vulnerable
Ubuntusqlite22.042.8.17-15fakesync1build1vulnerable
Ubuntusqlite322.043.35.5-1vulnerable
Ubuntusqlite322.043.36.0-2vulnerable
Ubuntusqlite322.043.37.2-2vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.1vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.3vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.4vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.5vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.6vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.7fixed
Ubuntusqlite324.043.42.0-1vulnerable
Ubuntusqlite324.043.44.0-1vulnerable
Ubuntusqlite324.043.44.2-1vulnerable
Ubuntusqlite324.043.45.0-1vulnerable
Ubuntusqlite324.043.45.1-1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.3vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.4vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.5vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.6vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.7fixed
Ubuntusqlite325.103.46.1-3vulnerable
Ubuntusqlite325.103.46.1-4vulnerable
Ubuntusqlite325.103.46.1-6vulnerable
Ubuntusqlite325.103.46.1-6ubuntu1vulnerable
Ubuntusqlite325.103.46.1-7vulnerable
Ubuntusqlite325.103.46.1-7build1vulnerable
Ubuntusqlite325.103.46.1-8vulnerable
Ubuntusqlite325.103.46.1-8ubuntu0.1vulnerable
Ubuntusqlite326.043.46.1-8vulnerable
Ubuntusqlite326.043.46.1-9vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.1vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.2fixed
Ubuntusqlite322.043.35.5-1vulnerable
Ubuntusqlite322.043.36.0-2vulnerable
Ubuntusqlite322.043.37.2-2vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.1vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.3vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.4vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.5vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.6vulnerable
Ubuntusqlite322.043.37.2-2ubuntu0.7fixed
Ubuntusqlite324.043.42.0-1vulnerable
Ubuntusqlite324.043.44.0-1vulnerable
Ubuntusqlite324.043.44.2-1vulnerable
Ubuntusqlite324.043.45.0-1vulnerable
Ubuntusqlite324.043.45.1-1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.1vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.3vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.4vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.5vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.6vulnerable
Ubuntusqlite324.043.45.1-1ubuntu2.7fixed
Ubuntusqlite326.043.46.1-8vulnerable
Ubuntusqlite326.043.46.1-9vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.1vulnerable
Ubuntusqlite326.043.46.1-9ubuntu0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansqlite3sourcesid3.53.2-1not yet assignedNot reportedNot reported
Debiansqlite3sourceforky3.53.2-1not yet assignedNot reportedNot reported
Debiansqlite3sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiansqlite3sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Cpesqlite3cpeNot reported3.45.1-1ubuntu2.7Not reportedNot reportedNot reported
CpelemoncpeNot reported3.45.1-1ubuntu2.7Not reportedNot reportedNot reported
Cpelibsqlite3-0cpeNot reported3.45.1-1ubuntu2.7Not reportedNot reportedNot reported
Cpelibsqlite3-devcpeNot reported3.45.1-1ubuntu2.7Not reportedNot reportedNot reported
Cpelibsqlite3-tclcpeNot reported3.45.1-1ubuntu2.7Not reportedNot reportedNot reported
Cpesqlite3-doccpeNot reported3.45.1-1ubuntu2.7Not reportedNot reportedNot reported
Cpesqlite3-toolscpeNot reported3.45.1-1ubuntu2.7Not reportedNot reportedNot reported
Ubuntusqlite3deb22.043.37.2-2ubuntu0.7Not reportedUBUNTU-CVE-2026-50812Not reported
Ubuntusqlite3deb24.043.45.1-1ubuntu2.7Not reportedUBUNTU-CVE-2026-50812Not reported
Ubuntusqlite3deb26.043.46.1-9ubuntu0.2Not reportedUBUNTU-CVE-2026-50812Not reported
Ubuntusqlite3deb22.043.37.2-2ubuntu0.7Not reportedUSN-8565-1Not reported
Ubuntusqlite3deb24.043.45.1-1ubuntu2.7Not reportedUSN-8565-1Not reported
Ubuntusqlite3deb26.043.46.1-9ubuntu0.2Not reportedUSN-8565-1Not reported

Notes

[trixie] sqlite3: Minor issue [bookworm] sqlite3: Minor issue, DoS

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [lemon]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

  • [libsqlite3-0]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

  • [libsqlite3-dev]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

  • [libsqlite3-tcl]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

  • [sqlite3]Affected
    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

  • [sqlite3-doc]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · all · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · all · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

  • [sqlite3-tools]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.40.1-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

    • 3.40.1-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · sqlite3 · debian · bookworm; nvd · sqlite3 · debian · 12

[Debian 13 (Trixie)]

  • [lemon]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-0]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-dev]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-ext-csv]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-ext-icu]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [libsqlite3-tcl]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [sqlite3]Affected
    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [sqlite3-doc]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · all · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · all · trixie

      Affected

      nvd · sqlite3 · debian · 13

  • [sqlite3-tools]Affected

    Source package: [sqlite3]

    Details (2)

    • 3.46.1-7+deb13u1 · amd64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

    • 3.46.1-7+deb13u1 · arm64 · trixie

      Affected

      nvd · sqlite3 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]