SQLite Session Flaw Lets Malicious Changesets Trigger Heap Out-of-Bounds Writes

A heap out-of-bounds write in SQLite’s optional Session extension allows an attacker-controlled changeset to corrupt memory when an application calls sqlite3changeset_apply() or related apply APIs. Reports describe reproductions against SQLite 3.53.4 and 3.54.0. Exposure requires a build with SQLITE_ENABLE_SESSION and an application that accepts untrusted changesets, such as synchronization data from a malicious peer; builds without the extension are not exposed. An AddressSanitizer reproduction demonstrated a 12-byte write into a 4-byte allocation, but remote code execution was not demonstrated.

The flaw arises when consecutive changeset table blocks use the same table name but declare increasing column counts. SQLite skips schema revalidation for the repeated name and reuses an undersized update-mask allocation, allowing subsequent processing to overwrite heap memory. Abraxas Labs reports that fixes were committed to trunk and branch-3.53 on August 17, 2026. Organizations should identify Session-enabled deployments that process externally supplied changesets and incorporate the fix; interim mitigations include disabling Session where unnecessary or rejecting repeated table blocks with inconsistent column counts.