Back Linuxsecurity

Ubuntu 26.04 SQLite Critical DoS Buffer Overread USN-8565

Linuxsecurity •LinuxSecurity Advisories • July 20, 2026

Several security issues were fixed in SQLite. Software Description: - sqlite3: C library that implements an SQL database engine Details: It was discovered that SQLite did not properly handle NULL pointer dereferences in the Session Extension when applying a corrupt changeset. An attacker could possibly use this issue to cause SQLite to crash, resulting in a denial of service. (CVE-2026-50812) It was discovered that SQLite had a buffer overread in the Session Extension when processing a corrupt changeset. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-50813)

Several security issues were fixed in SQLite.

Software Description:

- sqlite3: C library that implements an SQL database engine

It was discovered that SQLite did not properly handle NULL pointer

dereferences in the Session Extension when applying a corrupt changeset.

An attacker could possibly use this issue to cause SQLite to crash,

resulting in a denial of service. (CVE-2026-50812)

It was discovered that SQLite had a buffer overread in the Session

Extension when processing a corrupt changeset. An attacker could possibly

use this issue to obtain sensitive information. (CVE-2026-50813)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS sqlite3 3.46.1-9ubuntu0.2 Ubuntu 24.04 LTS sqlite3 3.45.1-1ubuntu2.7 Ubuntu 22.04 LTS sqlite3 3.37.2-2ubuntu0.7 In general, a standard system update will make all the necessary changes.

CVE-2026-50812, CVE-2026-50813

Ubuntu Security Notice USN-8565-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQLite Vulnerabilities Discovered in Ubuntu On July 8, 2026, two critical vulnerabilities were identified in SQLite's Session Extension, affecting multiple versions of the sqlite3 library used in Ubuntu. CVE-2026-50812 involves improper handling of NULL pointer dereferences, which could lead to a denial of service by crashing SQLite. CVE-2026-50813 pertains to a buffer overread that may allow attackers to access sensitive information. These vulnerabilities could impact systems running Ubuntu 22.04, 24.04, and 26.04 LTS. Users are advised to update their systems to mitigate these risks. The vulnerabilities were disclosed in a security notice on July 20, 2026. A standard system update will address these issues. 3 sources 71

Extracted Entities

Ubuntu 26.04 SQLite Critical DoS Buffer Overread USN-8565

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

CWE Weaknesses (2)

Platforms (1)