CVE-2026-39113 Memory corruption in n/a
An attacker can cause a denial of service in SQLite via a buffer overflow in the sqlar extension, affecting library users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39113?
CVE-2026-39113 is a medium-severity memory corruption vulnerability in n/a, published on 25 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components
Weakness: CWE-122
Which versions are affected by CVE-2026-39113?
Linux distribution packages (9)
lemon Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
sqlite Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
sqlite-analyzer Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
sqlite-debug Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
sqlite-devel Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
sqlite-doc Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
sqlite-libs Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
sqlite-tcl Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
sqlite-tools Red Hat:hummingbird:1 | All versions | 0:3.53.4-1.hum1 |
How do I fix CVE-2026-39113?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-39113 being exploited?
There is no known exploitation of CVE-2026-39113 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-39113, ECHO-ba17-0503-20ce, GHSA-g4fp-96fc-xc72, RHSA-2026:49665, UBUNTU-CVE-2026-39113, USN-8775-1.