What’s Vulnerable › Vulnerabilities

CVE-2026-11824: SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-09 · updated 2026-10-15
• Weakness: CWE-122

Description

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.

Affected products

• SQLite: before 3.53.2 — fixed in 3.53.2

How to fix

Upgrade to a fixed version: SQLite 3.53.2. Check the vendor advisory for mitigations.

References

• https://sqlite.org/releaselog/3_53_2.html
• https://sqlite.org/src/info/061febcf41ca
• https://sqlite.org/src/info/4a5ad516ea93
• https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate
• https://cert-portal.siemens.com/productcert/html/ssa-765416.html

Get alerted when CVE-2026-11824 or the next vulnerability affects your stack