CVE-2026-85698 - Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service

Back Back to CVE browser

MEDIUM

Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service

Published Sep 4, 2026

6.8

MEDIUM

CVSS 4.0

EPSS 0.17%

Description

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic when querying, causing denial of service in any application that opens untrusted database files.

Affected products

Vendor Tursodatabase Product Turso Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=0.8.0-pre.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tursodatabase

Turso

unaffected

Version	Status	Constraints
0	affected	<=0.8.0-pre.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-71147
Advisory
https://github.com/tursodatabase/turso
product
https://github.com/tursodatabase/turso/blob/v0.8.0-pre.8/core/storage/pager.rs
technical-description
https://github.com/tursodatabase/turso/issues/7473
issue-tracking
https://www.vulncheck.com/advisories/turso-through-0.8.0-pre.8-out-of-bounds-read-denial-of-service
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-71147		Advisory
https://github.com/tursodatabase/turso		product
https://github.com/tursodatabase/turso/blob/v0.8.0-pre.8/core/storage/pager.rs		technical-description
https://github.com/tursodatabase/turso/issues/7473		issue-tracking
https://www.vulncheck.com/advisories/turso-through-0.8.0-pre.8-out-of-bounds-read-denial-of-service		third-party-advisory