SQLite versions built with the session extension before 3.54.0 contain a heap buffer overflow in sqlite3changeset_apply(). When a table name is repeated in a subsequent changeset block with a larger column count, the function sessionUpdateFind() performs a memset past the undersized aUpdateMask allocation. This memory corruption can be leveraged by an attacker to overwrite arbitrary heap data, potentially enabling arbitrary code execution or causing a denial‑of‑service failure.

The vulnerability affects all SQLite installations that include the session extension and are running a version older than 3.54.0. This includes commonly used SQLite libraries compiled with the session module in the 3.53.x series and earlier.

The CVSS score of 8.5 classifies the issue as high severity, and the EPSS score is not available, so current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through crafted changesets supplied to an application that uses the session extension; an attacker with the ability to influence changeset content can trigger the overflow. If the application accepts changesets from remote users, the vulnerability could be exploited remotely; otherwise it requires local or privileged access to supply the crafted changeset.