Vulnerability RUSTSEC-2026-0502

SQLite versions before 3.54.0 can return uninitialized page-cache memory when a process opens a database file together with a sibling write-ahead-log (-wal) file whose page size differs from the database's. A crafted pair of files can make ordinary queries return stale bytes from the process's memory. The attack vector is local and needs the victim to open the files.

sqlcipher-src ships the SQLCipher amalgamation (SQLCipher is built on SQLite and contains the same sqlite3WalReadFrame code) for -sys crates to compile, so a build that uses it is susceptible to the vulnerability. The releases 419.0.3 to 419.0.6 bundle SQLCipher 4.19.0 on SQLite 3.53.4 and are affected. sqlcipher-src was updated in 420.0.0 (SQLCipher 4.20.0 on SQLite 3.54.1), which contains the fix. The releases 0.1.0 and 0.1.1 contain no SQLCipher source. libsqlite3-sys 0.39.0 and 0.39.1 depend on sqlcipher-src =419.0.6 for their bundled-sqlcipher feature.

Only a process that opens a database file, with its -wal, that a less trusted party could have written is exposed.