A buffer overflow exists in the SQLite sqlar extension, specifically within sqlarUncompressFunc, sqlar_uncompress, sqlite3_value_int64, and the underlying uncompress routine. This flaw, classified as CWE-122, allows an attacker to supply a crafted SQLAR archive that triggers a memory overflow during decompression, causing the SQLite process to crash and resulting in a denial of service for any application using the vulnerable library.

The vulnerability affects SQLite database engine builds that include Fossil check‑in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d or any later snapshots that incorporate the same commit. Any deployment that loads the sqlar extension from ext/misc/sqlar.c is potentially impacted.

The CVSS score of 4 and an EPSS score below 1% indicate a moderate severity and a low likelihood that this flaw will be actively exploited in the wild. The flaw is listed in CISA KEV as not being a known exploited vulnerability. An attacker can cause denial of service by supplying a malicious SQLAR archive that triggers the uncompress routine, which may be possible remotely if an application accepts arbitrary SQLAR input; otherwise the attack vector is likely local. Despite the low exploitation probability, the impact of a denial of service can be significant, especially in mission‑critical environments.