A NULL pointer dereference in SQLite’s Session Extension occurs when the function sqlite3changeset_apply_v3 applies a corrupt changeset blob. The bug causes the code to call sqlite3_value_type() with a NULL sqlite3_value pointer, leading to a crash that terminates the host process. The outcome is a denial of service condition for the application that uses SQLite.

SQLite 3.53.1 and any trunk builds prior to commit e807d4e3798efd53 that expose the session changeset apply functionality. Systems that accept arbitrary changeset data from untrusted sources are at risk.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of < 1% suggests that exploitation is unlikely in the wild. The vulnerability is not recorded in CISA’s KEV catalog. The likely attack vector is that an attacker must be able to supply a malformed changeset blob to the vulnerable function; this could be local or remote depending on how the application exposes the session functionality. The path to exploitation requires delivery of corrupt data and execution of sqlite3changeset_apply_v3, which triggers a crash.