Threat Investigation
Request a demo

CVE-2026-50812

Medium

Description

A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.

SeverityMedium
CVSS5.5
Exploit probability—
ProductSQLite Session Extension
PublishedJul 8, 2026
First seenJul 8, 2026
Weakness typeCWE-476NULL pointer dereference

How to fix

Update
  • SQLite SQLite Session Extensione807d4e3798efd53 or later

Affected products

ProductAffected versionsFixed in
SQLite SQLite Session Extension3.53.1 ≤ ve807d4e3798efd53

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.