Skip to content

CVE-2026-50812 on CTRL-OS 26.05

Aliases: CVE-2026-50812

Packages: sqlite

Status: Plausible

Advisory Information

A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.

Updates

2026-07-20 20:10 CEST

Metadata changes:

  • Status for package sqlite: “Plausible”

2026-07-20 20:00 CEST

Metadata changes:

  • Status for package sqlite: “New”