VDB
CVE-2026-50812
CVE-2026-50812
PUBLISHED
CVSS 5.5 MEDIUM
Reported by mitre · Published July 8, 2026
A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | n/a |
Timeline
- Jul 8, 2026 CVE Published
- Jul 8, 2026 CVE Updated
- Jul 9, 2026 EPSS Score
- Jul 9, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 27, 2026 EPSS Score
- Aug 28, 2026 Security Advisory
- Sep 16, 2026 EPSS Score