CVE-2026-85698 Overview
CVE-2026-85698 is an out-of-bounds read vulnerability [CWE-125] in the Turso database engine through version 0.8.0-pre.8. The flaw resides in the table-leaf page reader inside core/storage/pager.rs, which trusts an attacker-controlled cell-count field without performing bounds validation. An attacker who supplies a crafted database file can trigger an index-out-of-bounds panic during query execution. The resulting panic causes denial of service in any application that opens untrusted Turso database files. The issue affects local workflows where user-supplied database files are opened by trusted processes.
Critical Impact
Opening a malicious Turso database file causes the host application to panic, producing a reliable denial-of-service condition against services that ingest untrusted database files.
Affected Products
- Turso database engine through version 0.8.0-pre.8
- Applications embedding the vulnerable Turso core/storage/pager.rs code path
- Services that accept or process user-supplied database files using Turso
Discovery Timeline
- 2026-09-04 - CVE-2026-85698 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-85698
Vulnerability Analysis
The vulnerability exists in Turso's page reader logic responsible for parsing table-leaf pages from on-disk database files. Turso reads a cell-count value from the page header and uses it to iterate cell pointers without validating that the count fits within the page's actual data region. When the cell-count is inflated beyond the true number of cells, indexing operations extend past the page buffer boundary. Rust's runtime bounds checks then trigger a panic, unwinding the thread executing the query. The panic terminates the query and, depending on how the embedding application handles panics, can crash the host process.
Root Cause
The root cause is missing input validation on an attacker-controlled length field parsed from untrusted file contents. The table-leaf page reader in core/storage/pager.rs treats the on-disk cell-count as authoritative rather than clamping it to the page size or verifying it against structural invariants of the SQLite file format.
Attack Vector
Exploitation requires an attacker to deliver a crafted database file to a target application that opens it with Turso. The attacker modifies the cell-count field in a table-leaf page header and waits for the victim to issue a query that touches that page. No authentication is required, but user interaction is needed to open the malicious file. See GitHub Turso Issue #7473 and the VulnCheck Turso Advisory for additional technical detail.
No verified public proof-of-concept code is available. The vulnerability manifests during page parsing when the reader dereferences cell pointers beyond the allocated page buffer. Refer to the vulnerable source in the GitHub Turso Code File for the affected implementation.
Detection Methods for CVE-2026-85698
Indicators of Compromise
- Repeated Rust panic messages referencing index-out-of-bounds errors originating from core/storage/pager.rs.
- Unexpected process termination or thread aborts in services that opened externally supplied .db files.
- Application logs recording query failures immediately after loading a new database file from an untrusted source.
Detection Strategies
- Monitor application crash telemetry for panics whose stack traces include Turso page-reader frames.
- Inspect ingested database files for cell-count values that exceed the physical page size before opening them.
- Alert when service accounts that embed Turso experience abnormal restart loops correlated with file uploads.
Monitoring Recommendations
- Forward application stderr and panic logs into a centralized logging pipeline for correlation with file-ingest events.
- Track the version of the Turso dependency in software bills of materials and flag any build using 0.8.0-pre.8 or earlier.
- Enable file-provenance logging so analysts can trace crashed processes back to the originating database file.
How to Mitigate CVE-2026-85698
Immediate Actions Required
- Inventory all applications and services that embed Turso and identify those running 0.8.0-pre.8 or earlier.
- Restrict opening of Turso database files to trusted sources only until patched builds are deployed.
- Isolate any service that accepts user-uploaded database files behind a sandbox or restart supervisor to contain panics.
Patch Information
Refer to the GitHub Turso Database Repository for the latest release that addresses the missing bounds validation in the table-leaf page reader. Upgrade to a Turso version later than 0.8.0-pre.8 once the fix is available, and rebuild all downstream applications that statically link the library.
Workarounds
- Reject database files from untrusted users at the application boundary using upload allow-lists.
- Run Turso-embedding services under a process supervisor that automatically restarts on panic to limit downtime.
- Validate database file structure with a hardened parser before handing files to Turso for query execution.
# Configuration example: identify vulnerable Turso builds in a Cargo workspace
cargo tree --workspace | grep -E 'turso.*0\.(1|2|3|4|5|6|7|8\.0-pre\.[0-8])'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
