{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sqlite-custom-builds-2026-03-11-to-2026-04-01/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SQLite (custom builds 2026-03-11 to 2026-04-01)"],"_cs_severities":["medium"],"_cs_tags":["sqlite","sqlar","heap-buffer-overflow","denial-of-service"],"_cs_type":"advisory","_cs_vendors":["SQLite"],"content_html":"\u003cp\u003eCVE-2026-39113 is a memory-safety vulnerability in the optional SQLAR extension (\u003ccode\u003eext/misc/sqlar.c\u003c/code\u003e) of the SQLite library. The issue stems from a type-mismatch introduced in a March 2026 commit, where a 64-bit size value (\u003ccode\u003esz\u003c/code\u003e) is retrieved using \u003ccode\u003esqlite3_value_int64()\u003c/code\u003e but passed to \u003ccode\u003esqlite3_malloc()\u003c/code\u003e (which expects a 32-bit \u003ccode\u003eint\u003c/code\u003e on many platforms) for buffer allocation. Meanwhile, the zlib \u003ccode\u003euncompress()\u003c/code\u003e function retains the full 64-bit size, causing the library to allocate an insufficient buffer and perform an out-of-bounds heap write during decompression.\u003c/p\u003e\n\u003cp\u003eThe vulnerability affects custom builds and source snapshots derived from the Git commit \u003ccode\u003e169f68e\u003c/code\u003e (2026-03-11) through the parent of \u003ccode\u003e34e139d\u003c/code\u003e (2026-04-01). Official releases 3.52.0 (pre-introduction) and 3.53.0 (contains the fix) are not affected. While researchers demonstrated heap corruption leading to process termination (denial of service), arbitrary code execution was not achieved. The flaw is only reachable in applications that explicitly load the SQLAR extension and permit untrusted input to the \u003ccode\u003esqlar_uncompress()\u003c/code\u003e SQL function.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this vulnerability is primarily focused on denial of service via process crashes. Because the flaw occurs within the host process memory space, exploitation results in immediate heap corruption detected by AddressSanitizer or standard memory management handlers. While theoretical primitives for heap exploitation exist, no remote code execution chain was demonstrated. Organizations utilizing custom-built SQLite binaries or development snapshots between March and April 2026 are at risk if they enable the SQLAR extension in internet-facing or multi-tenant applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all custom-built SQLite binaries and source snapshots within the development environment to determine if they fall within the vulnerable commit range.\u003c/li\u003e\n\u003cli\u003eUpgrade any affected custom builds to the official SQLite 3.53.0 release or later, which utilizes \u003ccode\u003esqlite3_malloc64()\u003c/code\u003e to resolve the allocation-width mismatch.\u003c/li\u003e\n\u003cli\u003eAudit applications that load the \u003ccode\u003esqlar.c\u003c/code\u003e extension and implement strict input validation for the \u003ccode\u003eSZ\u003c/code\u003e argument in \u003ccode\u003esqlar_uncompress()\u003c/code\u003e to ensure it does not exceed reasonable bounds.\u003c/li\u003e\n\u003cli\u003eIf the SQLAR extension is not business-critical, disable it in the application configuration to remove the attack vector entirely.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-21T12:36:14Z","date_published":"2026-08-21T12:36:14Z","id":"https://feed.craftedsignal.io/briefs/2026-08-sqlite-sqlar-overflow/","summary":"A heap buffer overflow in the SQLite SQLAR extension (CVE-2026-39113) occurs when an attacker triggers sqlar_uncompress with a 64-bit size value that gets truncated during memory allocation, leading to heap corruption and potential denial of service.","title":"Heap Buffer Overflow in SQLite SQLAR Extension (CVE-2026-39113)","url":"https://feed.craftedsignal.io/briefs/2026-08-sqlite-sqlar-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - SQLite (Custom Builds 2026-03-11 to 2026-04-01)","version":"https://jsonfeed.org/version/1.1"}