CVE-2026-119379: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
CVE-2026-119379 is a vulnerability in SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind(), rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.18% probability of exploitation activity in the next 30 days, higher than 8% of all scored vulnerabilities. Microsoft released the fix on 31 October 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).
Key facts
- CVE ID
- CVE-2026-119379
- Severity
- High CVSS 7.8
- Microsoft severity
- Important
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-787
- EPSS
- 0.18% (percentile 8%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- October 2026 Patch Tuesday
- Product families
- Open Source Software
CVSS score and vector
Microsoft scores CVE-2026-119379 at 7.8 (temporal 7.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
Affected products (1)
Open Source Software
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| azl3 sqlite 3.44.0-4 on Azure Linux 3.0 | Release Notes | Security Update |
NIST NVD data
- NVD status
- Awaiting Analysis
- NVD CVSS
- 7.8 (HIGH)
- NVD weakness
- CWE-787
- Published to NVD
- NVD last modified
References
- https://abraxaslabs.tech/research/sqlite-session-ncol
- https://github.com/sqlite/sqlite
- https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619
- https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52
- https://sqlite.org/bugs/info/2026-08-16T10:15:25Z
- https://sqlite.org/releaselog/3_54_0.html
- https://sqlite.org/src/info/3f57024aecea0f3b
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |