{"id":"CVE-2026-85698","summary":"Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service","details":"Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic when querying, causing denial of service in any application that opens untrusted database files.","modified":"2026-09-06T03:47:21.952474698Z","published":"2026-09-04T14:32:40.170Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85698.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-125"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85698.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85698"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/turso-through-0.8.0-pre.8-out-of-bounds-read-denial-of-service"},{"type":"REPORT","url":"https://github.com/tursodatabase/turso/issues/7473"},{"type":"PACKAGE","url":"https://github.com/tursodatabase/turso"},{"type":"ARTICLE","url":"https://github.com/tursodatabase/turso/blob/v0.8.0-pre.8/core/storage/pager.rs"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tursodatabase/turso","events":[{"introduced":"0"},{"fixed":"9384daad3b3a646d36e27d726dea8c5330024fc5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.8.0-pre.8"},{"fixed":"0.8.0-pre.8"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v0.8.0-pre.7","v0.8.0-pre.6","v0.8.0-pre.5","v0.8.0-pre.4","v0.8.0-pre.3","v0.8.0-pre.2","v0.8.0-pre.1","v0.7.0","v0.7.0-pre.22","v0.7.0-pre.20","v0.7.0-pre.19","v0.7.0-pre.18","v0.7.0-pre.14","v0.7.0-pre.13","v0.7.0-pre.12","v0.7.0-pre.11","v0.7.0-pre.10","v0.7.0-pre.9","v0.7.0-pre.8","v0.7.0-pre.7","v0.7.0-pre.6","v0.7.0-pre.5","v0.7.0-pre.4","v0.7.0-pre.2","v0.7.0-pre.1","v0.6.0","v0.6.0-pre.31","v0.6.0-pre.29","v0.6.0-pre.28","v0.6.0-pre.27","v0.6.0-pre.26","v0.6.0-pre.25","v0.6.0-pre.24","v0.6.0-pre.23","v0.6.0-pre.22","v0.6.0-pre.21","v0.6.0-pre.20","v0.6.0-pre.19","v0.6.0-pre.18","v0.6.0-pre.17","v0.6.0-pre.16","v0.6.0-pre.15","v0.6.0-pre.14","v0.6.0-pre.13","v0.6.0-pre.12","v0.6.0-pre.11","v0.6.0-pre.10","v0.6.0-pre.8","v0.6.0-pre.9","v0.6.0-pre.7","v0.6.0-pre.6","v0.6.0-pre.4","v0.6.0-pre.5","v0.6.0-pre.3","v0.6.0-pre.2","v0.6.0-pre.1","v0.5.0-pre.20","v0.5.0-pre.19","v0.5.0-pre.18","v0.5.0-pre.15","v0.5.0-pre.16","v0.5.0-pre.14","v0.5.0-pre.13","v0.5.0-pre.12","v0.5.0-pre.11","v0.5.0-pre.10","v0.5.0-pre.9","v0.5.0-pre.7","v0.5.0-pre.6","v0.5.0-pre.5","v0.5.0-pre.4","v0.5.0-pre.2","v0.5.0-pre.1","v0.4.0","v0.4.0-pre.21","v0.4.0-pre.20","v0.4.0-pre.18","v0.4.0-pre.17","v0.4.0-pre.16","v0.4.0-pre.15","v0.4.0-pre.14","v0.4.0-pre.13","v0.4.0-pre.12","v0.4.0-pre.11","v0.4.0-pre.10","v0.4.0-pre.9","v0.4.0-pre.8","v0.4.0-pre.7","v0.4.0-pre.6","v0.4.0-pre.5","v0.4.0-pre.4","v0.4.0-pre.3","v0.4.0-pre.2","v0.4.0-pre.1","v0.3.0","v0.3.0-pre.7","v0.3.0-pre.6","v0.3.0-pre.5","v0.3.0-pre.4","v0.3.0-pre.3","v0.3.0-pre.2","v0.3.0-pre.1","v0.2.0","v0.2.0-pre.15","v0.2.0-pre.14","v0.2.0-pre.13","v0.2.0-pre.11","v0.2.0-pre.10","v0.2.0-pre.9","v0.2.0-pre.8","v0.2.0-pre.7","v0.2.0-pre.6","v0.2.0-pre.5","v0.2.0-pre.4","v0.2.0-pre.3","v0.2.0-pre.2","v0.2.0-pre.1","v0.1.5","v0.1.5-pre.5","v0.1.5-pre.4","v0.1.5-pre.3","v0.1.5-pre.2","v0.1.5-pre.1","v0.1.4","v0.1.4-pre.11","v0.1.4-pre.10","v0.1.4-pre.9","v0.1.4-pre.8","v0.1.4-pre.7","v0.1.4-pre.6","v0.1.4-pre.5","v0.1.4-pre.4","v0.1.4-pre.3","v0.1.4-pre.2","v0.1.4-pre.1","v0.1.3","v0.1.3-pre.10","v0.1.3-pre.9","v0.1.3-pre.8","v0.1.3-pre.7","v0.1.3-pre.6","v0.1.3-pre.5","v0.1.3-pre.4","v0.1.3-pre.2","v0.1.3-pre.3","v0.1.3-pre.1","v0.1.2","v0.1.2-pre.3","v0.1.2-pre.4","v0.1.2-pre.2","v0.1.2-pre.1","v0.1.1","v0.1.0-pre.5","v0.1.1-pre.2","v0.1.1-pre.1","v0.1.0","v0.1.0-pre.4","v0.1.0-pre.3","v0.1.0-pre.2","v0.1.0-pre.1","v0.0.22","v0.0.22-pre.5","v0.0.22-pre.4","v0.0.22-pre.3","v0.0.22-pre.2","v0.0.22-pre.1","v0.0.21","v0.0.21-pre.2","v0.0.21-pre.1","v0.0.20","v0.0.20-pre.2","v0.0.19","v0.0.19-pre.5","v0.0.19-pre.4","v0.0.19-pre.3","v0.0.19-pre.2","v0.0.18","v0.0.18-pre.5","v0.0.18-pre.4","v0.0.18-pre.2","v0.0.18-pre.1","v0.0.17","v0.0.16","v0.0.15","v0.0.14","v0.0.13","v0.0.12","v0.0.11","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85698.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}