Every CVE Search/ Get API key

CVE-2026-39113

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing...

4.0 MediumPublic exploitFix available

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.19%Down 0.1 points since Aug 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.0

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Record
CVE-2026-39113
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-66176 4.0

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Record
EUVD-2026-66176
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-g4fp-96fc-xc72 4.0

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing...

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Record
GHSA-g4fp-96fc-xc72
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-122
Updated
2026-11-02
NVD 4.0

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Record
CVE-2026-39113
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-122
Updated
2026-11-02
OSVBELL-CVE-2026-39113 4.0

CVE-2026-39113 does not affect BellSoft software

Record
BELL-CVE-2026-39113
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 4.0

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Record
CVE-2026-39113
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2026-39113 4.0

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Record
DEBIAN-CVE-2026-39113
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:49665 5.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:49665
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-39113 4.0

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Record
UBUNTU-CVE-2026-39113
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUSN-8775-1 No score

sqlite3 vulnerability

It was discovered that SQLite was vulnerable to a buffer overflow in the sqlar extension. If a user were tricked into opening a specially crafted SQLar archive, an attacker could cause a denial of service.

Record
USN-8775-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
sqlite3
Debian:13
 All versions, plus listed versions
3.46.1-73.46.1-7+deb13u13.46.1-7+deb13u23.46.1-83.46.1-9
Show 4 moreShow less
3.53.2-13.53.3-13.53.4-13.53.4-2
 None known
sqlite3
Debian:14
 before 3.53.2-1, plus listed versions
3.46.1-73.46.1-83.46.1-9
3.53.2-1
lemon
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
sqlite
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
sqlite-analyzer
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
sqlite-debug
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
sqlite-devel
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
sqlite-doc
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
sqlite-libs
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
sqlite-tcl
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
sqlite-tools
Red Hat:hummingbird:1
 before 0:3.53.4-1.hum1
0:3.53.4-1.hum1
sqlite
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.8.17-8fakesync12.8.17-9fakesync12.8.17-10ubuntu2
 None known
sqlite
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.8.17-12fakesync1
 None known
sqlite3
Ubuntu:Pro:18.04:LTS
 before 3.22.0-1ubuntu0.7+esm3, plus listed versions
3.19.3-33.20.1-23.21.0-13.22.0-13.22.0-1ubuntu0.1
Show 8 moreShow less
3.22.0-1ubuntu0.23.22.0-1ubuntu0.33.22.0-1ubuntu0.43.22.0-1ubuntu0.53.22.0-1ubuntu0.63.22.0-1ubuntu0.73.22.0-1ubuntu0.7+esm13.22.0-1ubuntu0.7+esm2
3.22.0-1ubuntu0.7+esm3
sqlite
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.17-14fakesync1
 None known
sqlite3
Ubuntu:Pro:20.04:LTS
 before 3.31.1-4ubuntu0.7+esm2, plus listed versions
3.29.0-23.30.1-13.30.1-1ubuntu13.31.1-1ubuntu13.31.1-3
Show 9 moreShow less
3.31.1-43.31.1-4ubuntu0.13.31.1-4ubuntu0.23.31.1-4ubuntu0.33.31.1-4ubuntu0.43.31.1-4ubuntu0.53.31.1-4ubuntu0.63.31.1-4ubuntu0.73.31.1-4ubuntu0.7+esm1
3.31.1-4ubuntu0.7+esm2
sqlite
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.8.17-15fakesync1build1
 None known
sqlite
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.8.17-15fakesync1build1
 None known
sqlite3
Ubuntu:22.04:LTS
 before 3.37.2-2ubuntu0.8, plus listed versions
3.35.5-13.36.0-23.37.2-23.37.2-2ubuntu0.13.37.2-2ubuntu0.3
Show 4 moreShow less
3.37.2-2ubuntu0.43.37.2-2ubuntu0.53.37.2-2ubuntu0.63.37.2-2ubuntu0.7
3.37.2-2ubuntu0.8
sqlite3
Ubuntu:24.04:LTS
 before 3.45.1-1ubuntu2.8, plus listed versions
3.42.0-13.44.0-13.44.2-13.45.0-13.45.1-1
Show 8 moreShow less
3.45.1-1ubuntu13.45.1-1ubuntu23.45.1-1ubuntu2.13.45.1-1ubuntu2.33.45.1-1ubuntu2.43.45.1-1ubuntu2.53.45.1-1ubuntu2.63.45.1-1ubuntu2.7
3.45.1-1ubuntu2.8
sqlite3
Ubuntu:26.04:LTS
 before 3.46.1-9ubuntu0.3, plus listed versions
3.46.1-83.46.1-93.46.1-9ubuntu0.13.46.1-9ubuntu0.2
3.46.1-9ubuntu0.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub20000419/CVE-2026-391132026-08-21

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-39113 is a medium vulnerability (CVSS 4.0) in sqlite3, published August 25, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in sqlite3 3.53.2-1.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open