SQLite before version 3.54.0 contains an information disclosure flaw that allows an attacker to read uninitialized page‑cache memory by supplying a WAL file whose page size is shorter than the database’s page size. When a query such as substr() accesses the oversized payload, the engine returns stale bytes from the memory region, leaking other table rows and internal pointers. The weakness is a failure to correctly initialize memory during WAL processing (CWE‑908).

All releases of SQLite earlier than 3.54.0 are affected. The product is SQLite’s SQLite database engine.

The CVSS score of 6.8 indicates a moderate severity vulnerability. The EPSS score is not available, so the current probability of exploitation is unknown. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit this by crafting a malicious WAL file and executing queries against a target SQLite database; the likely attack vector is a local or file‑based compromise where the attacker can control the WAL file used by the application.