gistfile1.txt

# CVE-2026-50813

Out-of-bounds read and constrained output disclosure in the SQLite Session Extension changeset concat/changegroup merge path via a malformed changeset blob.

------------------------------------------

[Vulnerability Type]
Out-of-bounds Read / Buffer Over-read
CWE-126

------------------------------------------

[Vendor of Product]
SQLite

------------------------------------------

[Affected Product Code Base]
Confirmed affected:
- SQLite 3.53.1 with the Session Extension enabled
- SQLite development trunk builds before check-in 869a51ae84df

------------------------------------------

[Affected Component]
SQLite Session Extension
sqlite3changeset_concat()
sqlite3changegroup_add()
sessionVarintGet()
sessionSerialLen()
sessionMergeValue()
sessionMergeUpdate()
sessionChangeMerge()

------------------------------------------

[Attack Vectors]
An application processes an attacker-controlled malformed changeset blob using sqlite3changeset_concat(), or calls sqlite3changegroup_add() repeatedly so that the Session Extension merge path is reached.

The minimal ASan-reproduced malformed changeset is 13 bytes:
540101740017000003ffffffff

The output-disclosure PoC uses a 16-byte logical changeset buffer followed by an adjacent token field. The caller passes only nData=16, but vulnerable builds can copy adjacent bytes into the output changeset.

------------------------------------------

[Impact]
Confidentiality and availability impact as currently demonstrated.

The malformed changeset can cause sqlite3GetVarint() to read beyond the caller-specified logical changeset boundary while the Session Extension merge path parses a truncated high-bit TEXT varint. Under ASan/UBSan this is reported as a heap-buffer-overflow READ.

In normal non-ASan builds, constrained adjacent bytes can be copied into the output changeset. In the submitted PoC, the adjacent token bytes deadbeef appear as an output suffix:

concat_rc=0 nOut=20 out=540201007400170000000003ffffffffdeadbeef
changegroup_first_rc=0 second_rc=0 output_rc=0 nOut=20 out=540201007400170000000003ffffffffdeadbeef

The demonstrated disclosure is limited: in this PoC shape it is capped at four bytes and depends on high-bit varint-continuation bytes. No out-of-bounds write, integrity impact, ASLR bypass, or code execution is claimed.

------------------------------------------

[References]
https://sqlite.org/src/info/869a51ae84df
https://github.com/sqlite/sqlite/commit/c597ed79d1bd03f57198d10d1f431adda293cf2e

------------------------------------------

[Discoverers]
Junsu Han
- GitHub: https://github.com/junius-sec