CVE-2026-50812: SQLite Session Extension DoS Vulnerability

CVE-2026-50812 Overview

CVE-2026-50812 is a NULL pointer dereference vulnerability [CWE-476] in the SQLite Session Extension. The flaw affects SQLite 3.53.1 and trunk builds before check-in e807d4e3798efd53. An attacker who supplies a malformed changeset blob can trigger a denial of service condition. The issue occurs when sqlite3changeset_apply_v3() processes a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer. Exploitation requires local access and low privileges but no user interaction. The vulnerability affects application availability without compromising confidentiality or integrity.

Critical Impact
Local attackers can crash SQLite-based applications by submitting malformed changeset blobs to the Session Extension, resulting in denial of service.

Affected Products

SQLite 3.53.1
SQLite trunk builds before check-in e807d4e3798efd53
Applications embedding the SQLite Session Extension

Discovery Timeline

2026-07-08 - CVE-2026-50812 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-50812

Vulnerability Analysis

The vulnerability resides in the SQLite Session Extension, which tracks and applies database changes through changeset blobs. When sqlite3changeset_apply_v3() iterates over columns in a corrupt changeset, it calls sessionChangesetOld() to retrieve the old value for each column. A malformed changeset can cause this function to return a NULL pointer. The code then passes this NULL pointer to sqlite3_value_type() via sessionBindValue(), causing a NULL pointer dereference and process termination.

Root Cause

The root cause is an ordering issue in the conditional check that guards the call to sessionBindValue(). The original code checked p->abPK[i] || (bPatchset==0 && pOld), which allowed execution to proceed when abPK[i] was true even if pOld was NULL. The primary key column check took precedence over the NULL validation, permitting NULL pointer usage downstream.

Attack Vector

Exploitation requires an attacker to supply a crafted, malformed changeset blob to an application that invokes sqlite3changeset_apply_v3(). This typically occurs in applications that accept changesets from untrusted sources for database replication or synchronization. The attacker needs local access with low privileges to the affected system.

     for(i=0; rc==SQLITE_OK && i<nCol; i++){
       sqlite3_value *pOld = sessionChangesetOld(pIter, i);
       sqlite3_value *pNew = sessionChangesetNew(pIter, i);
-      if( p->abPK[i] || (bPatchset==0 && pOld) ){
+      if( pOld && (p->abPK[i] || bPatchset==0) ){
         rc = sessionBindValue(pUp, i*2+2, pOld);
       }
       if( rc==SQLITE_OK && pNew ){

Source: SQLite Commit b869ed6. The patch reorders the conditional to require pOld to be non-NULL before evaluating the primary key or patchset conditions.

Detection Methods for CVE-2026-50812

Indicators of Compromise

Unexpected crashes or segmentation faults in applications using the SQLite Session Extension
Core dumps referencing sqlite3_value_type() or sessionBindValue() in the stack trace
Application logs showing abnormal termination during changeset apply operations

Detection Strategies

Inventory applications linked against SQLite 3.53.1 or trunk builds predating check-in e807d4e3798efd53
Audit code paths that call sqlite3changeset_apply_v3() on externally sourced data
Enable core dump collection to capture NULL pointer dereferences in SQLite session code

Monitoring Recommendations

Monitor process termination events for applications embedding SQLite with the session extension enabled
Track file operations involving .changeset blob inputs from untrusted origins
Alert on repeated crashes of the same SQLite-linked binary indicating potential exploitation attempts

How to Mitigate CVE-2026-50812

Immediate Actions Required

Update SQLite to a build that includes check-in e807d4e3798efd53 or later
Rebuild and redeploy applications that statically link the SQLite Session Extension
Validate changeset blob sources and reject inputs from untrusted parties until patched

Patch Information

The fix is available in the SQLite Commit b869ed6b067d623cb1383549f2a18aa35508385d applied to ext/session/sqlite3session.c. Additional details are documented in the SQLite Security Advisory. Upgrade to a SQLite release incorporating this commit.

Workarounds

Disable the SQLite Session Extension if changeset apply functionality is not required
Restrict sqlite3changeset_apply_v3() invocations to changesets from trusted, authenticated sources
Implement input validation to reject malformed changeset blobs before passing them to the session API

bash

# Verify SQLite version and rebuild against patched source
sqlite3 --version
git clone https://github.com/sqlite/sqlite.git
cd sqlite
git checkout b869ed6b067d623cb1383549f2a18aa35508385d
./configure && make