CVE-2026-50812 Null dereference in n/a
An attacker can cause a denial of service in SQLite by supplying a malformed changeset blob that triggers a NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50812?
CVE-2026-50812 is a medium-severity vulnerability in n/a, published on 8 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.
Weakness: CWE-476
Which versions are affected by CVE-2026-50812?
Linux distribution packages (9)
lemon Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
sqlite Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
sqlite-analyzer Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
sqlite-debug Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
sqlite-devel Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
sqlite-doc Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
sqlite-libs Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
sqlite-tcl Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
sqlite-tools Red Hat:hummingbird:1 | All versions | 0:3.53.3-1.hum1 |
How do I fix CVE-2026-50812?
Apply the vendor's patch.
Is CVE-2026-50812 being exploited?
There is no known exploitation of CVE-2026-50812 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-50812, DEBIAN-CVE-2026-50812, ECHO-f08c-2b40-760b, GHSA-f8h2-hw8x-2jh9, OESA-2026-3492, OESA-2026-3493 and 4 more.