Is CVE-2026-119379 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119379?

CVE-2026-119379 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-119379

Description

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.