CVE-2026-50812

Name of the Vulnerable Software and Affected Versions SQLite version 3.53.1 SQLite trunk builds prior to check-in e807d4e3798efd53

Description A NULL pointer dereference in the SQLite Session Extension allows an attacker to cause a denial of service by supplying a malformed changeset blob. This occurs when the sqlite3changeset apply v3() function applies a corrupt changeset and calls sqlite3 value type() using a NULL sqlite3 value pointer.

Recommendations Update SQLite version 3.53.1 to a version containing the fix. Update SQLite trunk builds to check-in e807d4e3798efd53 or later.