CVE-2026-39113

Published Aug 25, 2026

Last updated a month ago

CVSS medium 4.0
SQLite
SQLAR

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-39113 describes a heap buffer overflow vulnerability found within the optional SQLAR extension of SQLite. This flaw specifically resides in the `sqlar_uncompress()` function. The vulnerability can lead to a process crash due to an oversized write operation involving zlib. An attacker could exploit this issue in applications that have loaded the SQLAR extension, provided they can invoke the vulnerable function.

Description
Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components
Source
cve@mitre.org
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
4
Impact score
1.4
Exploitability score
2.5
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity
MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-122

Social media

Hype score
Not currently trending

  1. ‼️ CVE-2026-39113: Heap Buffer Overflow in SQLite's Optional SQLAR Extension GitHub: https://t.co/EtIl5UGJcJ https://t.co/RTv1pOuRn9

    @DarkWebInformer

    22 Aug 2026

    4089 Impressions

    1 Retweet

    16 Likes

    3 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.•CVE-2025-6965

References

Sources include official advisories and independent security research.