CVE-2026-39113: SQLite Buffer Overflow Vulnerability

CVE-2026-39113 Overview

CVE-2026-39113 is a buffer overflow vulnerability in the SQLite SQL Archive (SQLAR) extension. The flaw resides in ext/misc/sqlar.c and affects the sqlarUncompressFunc() and sqlar_uncompress() routines. An attacker can trigger the condition by supplying a crafted size value that is processed through sqlite3_value_int64() and passed to sqlite3_malloc(int) before uncompress() is called. The mismatch between the 64-bit input handling and the 32-bit allocation path leads to memory corruption and denial of service. Affected source snapshots include Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later builds until patched.

Critical Impact
Attackers can crash SQLite processes that expose the SQLAR extension, disrupting applications that rely on SQLite archive functionality.

Affected Products

SQLite source snapshots containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d
SQLite Git mirror commit 169f68ed88b34cb68f720191c64c058f2ccec508 (2026-03-11) and later snapshots
Applications embedding the SQLite ext/misc/sqlar.c extension

Discovery Timeline

2026-08-25 - CVE CVE-2026-39113 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-39113

Vulnerability Analysis

The SQLAR extension implements SQL Archive support inside SQLite, allowing compressed file storage inside a database. The vulnerable path lives in sqlarUncompressFunc(), which reads a caller-supplied size argument and uses it to allocate a buffer before decompressing data with uncompress(). The size value flows through integer conversion routines and a subsequent allocation call. Improper handling between signed integer conversion and the allocator produces an undersized or invalid buffer during decompression. The result is a memory corruption condition that leads to a process crash and denial of service.

Root Cause

The root cause is inconsistent integer width handling in the SQLAR decompression path. The original code retrieved the target size using sqlite3_value_int(), which returns a 32-bit signed integer. When a caller supplied a value larger than a 32-bit signed range, the truncated value drove the subsequent allocation, allowing decompression into a buffer smaller than the attacker-controlled expansion target.

Attack Vector

An attacker who can influence values passed to the sqlar_uncompress() SQL function can trigger the overflow. This includes scenarios where applications expose SQL query surfaces containing SQLAR calls or accept untrusted SQLAR archives for extraction. Successful exploitation crashes the SQLite process handling the query, denying service to dependent applications.

// Patch applied in ext/misc/sqlar.c
  sqlite3_int64 sz;

  assert( argc==2 );
- sz = sqlite3_value_int(argv[1]);
+ sz = sqlite3_value_int64(argv[1]);

  if( sz<=0 || sz==(nData = sqlite3_value_bytes(argv[0])) ){
    sqlite3_result_value(context, argv[0]);

Source: SQLite Commit 169f68ed88

Detection Methods for CVE-2026-39113

Indicators of Compromise

Unexpected termination or segmentation faults in processes that link SQLite with the SQLAR extension enabled.
Application logs showing crashes immediately after invocation of sqlar_uncompress() on untrusted input.
Core dumps referencing sqlarUncompressFunc or uncompress frames during SQL query execution.

Detection Strategies

Inventory applications and services that embed SQLite and confirm whether the SQLAR extension is compiled in or loaded at runtime.
Audit SQL query surfaces for calls to sqlar_uncompress() where the size parameter derives from untrusted input.
Compare the SQLite source revision in shipped binaries against the patched commit 169f68ed88b34cb68f720191c64c058f2ccec508.

Monitoring Recommendations

Monitor process crash telemetry and watchdog restarts on hosts running database-backed services that use SQLAR.
Alert on repeated failures of the same SQLite-linked process to identify possible denial-of-service attempts.
Track ingestion of externally sourced SQLAR archives and correlate with subsequent process instability.

How to Mitigate CVE-2026-39113

Immediate Actions Required

Update embedded SQLite to a build that includes the fix from commit 169f68ed88b34cb68f720191c64c058f2ccec508 or later.
Restrict exposure of the sqlar_uncompress() SQL function to trusted callers only.
Reject untrusted SQLAR archives at the application boundary until dependencies are patched.

Patch Information

The upstream fix replaces sqlite3_value_int() with sqlite3_value_int64() in sqlarUncompressFunc(), ensuring the target size uses the correct integer width before allocation. Rebuild SQLite from source at or after the patched Git commit 169f68ed88b34cb68f720191c64c058f2ccec508. See the SQLite Commit Update and the SQLite SQLAR Documentation for details.

Workarounds

Disable the SQLAR extension by building SQLite without ext/misc/sqlar.c where archive functionality is not required.
Wrap sqlar_uncompress() invocations with server-side validation that constrains the size argument to safe bounds.
Isolate SQLite-backed services that must accept untrusted archives in sandboxed processes with automatic restart supervision.

bash

# Verify the SQLite source revision in a local checkout
cd sqlite
git log -1 --pretty=oneline ext/misc/sqlar.c
# Ensure the commit hash matches or is newer than:
# 169f68ed88b34cb68f720191c64c058f2ccec508