CVE-2026-85698: Out-of-bounds Read in tursodatabase turso

The vulnerability in Turso (up to 0.8.0-pre.8) involves an out-of-bounds read in the table-leaf page reader. The component relies on a cell-count field that is attacker-controlled and lacks bounds checking. By manipulating this field in a malicious database file, an attacker can cause an index-out-of-bounds panic when the database is queried. This leads to a denial of service condition in any application that opens such untrusted database files.

Successful exploitation causes a denial of service due to an index-out-of-bounds panic triggered by maliciously crafted database files. There is no indication of code execution or data corruption beyond service disruption. The vulnerability requires local access to supply a malicious database file and user interaction to open it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted database files with affected versions of Turso to prevent denial of service.