Description

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic when querying, causing denial of service in any application that opens untrusted database files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-04T15:17:48.817Z",
  "pubdate": "2026-09-04T15:17:48.817Z",
  "executiveSummary": "Turso versions through 0.8.0-pre.8 contain an out-of-bounds (OOB) read vulnerability located within the table-leaf page reader component. This flaw stems from a critical lack of input validation regarding the cell-count field within database files. An attacker can craft a malicious database file, specifically manipulating the cell-count metadata, to force the application to read outside of designated memory bounds.\nThe primary impact of this vulnerability is a denial-of-service (DoS) condition, triggered when the application performs a query on the malicious database file. The resulting index-out-of-bounds error forces a runtime panic, leading to immediate process termination. This vulnerability poses a significant risk to any application that accepts and processes untrusted database files. Exploitation is straightforward, requiring only that a victim application attempts to open or query a specially crafted database file. Because this does not require authentication or specific network conditions, it effectively turns any database-processing feature into an attack vector.",
  "technicalDetails": "The vulnerability resides in the internal logic responsible for parsing database page structures, specifically the table-leaf page reader. During the deserialization or traversal of a database page, the component reads a 'cell-count' field directly from the file header/metadata without performing any bounds checking against the actual data length or the allocated buffer size.\nThe root cause is an improper trust assumption regarding the integrity of the cell-count field stored within the database file format. In a legitimate database file, the cell count corresponds to the actual number of cell pointers and payload entries present in the leaf page. By inflating this value in a malicious file, an attacker manipulates the internal loop logic that iterates through page contents.\nWhen an application queries the malicious file, the reader initializes an iteration loop based on the attacker-supplied cell-count. The logic attempts to access an index corresponding to the cell-count position. Since the actual memory allocated for the leaf page is significantly smaller than the provided cell-count value, the pointer arithmetic used to index the cell array traverses beyond the valid buffer boundaries.\nThis out-of-bounds access triggers a memory access violation or a language-level panic (depending on the implementation language of the Turso runtime), resulting in an immediate crash of the host process. The attack flow is as follows: 1) The attacker constructs a malformed database file where the table-leaf page metadata defines a cell-count value greater than the actual data records present. 2) The attacker distributes or hosts this malicious file for target consumption. 3) The target application uses Turso to open the file and executes a query. 4) The table-leaf page reader processes the malicious cell-count, iterates past the intended memory bounds, and triggers a panic. 5) The application crashes, resulting in denial of service.\nBecause the vulnerability manifests during standard read operations, no authentication or special privileges are required by the attacker. Any system component that automatically processes Turso-compatible database files is susceptible to this runtime disruption."
}