CVE-2026-39113: n/a

CVE-2026-39113 is a buffer overflow vulnerability affecting SQLite source snapshots/builds from the Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and subsequent builds. The vulnerability resides in the ext/misc/sqlar.c file, involving the sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), and uncompress() functions. Exploitation can cause a denial of service by triggering a buffer overflow. The attack vector is local (AV:L), with low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts availability only (A:L) without affecting confidentiality or integrity. No known exploits are reported in the wild, and no official patch or remediation level has been published.

The vulnerability allows an attacker with local access to cause a denial of service by triggering a buffer overflow in specific SQLite functions related to SQLAR uncompression. There is no impact on confidentiality or integrity. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected SQLite snapshots/builds from the specified Fossil check-in onward if possible. Monitor vendor channels for updates and apply official patches once released.