Skip to main content

SQLite CVE-2026-11822

| EUVDEUVD-2026-35794 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-09 VulnCheck GHSA-6qj8-gw6p-hc5p
8.5
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

5
Analysis Updated
Jun 09, 2026 - 20:44 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 09, 2026 - 20:43 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 09, 2026 - 20:22 vuln.today
cvss_changed
CVSS changed
Jun 09, 2026 - 20:22 NVD
7.8 (HIGH) 8.5 (HIGH)
Analysis Generated
Jun 09, 2026 - 20:09 vuln.today

DescriptionCVE.org

SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.

AnalysisAI

Memory corruption in SQLite versions before 3.53.2 enables attackers to crash processes, exhaust memory, or potentially execute arbitrary code by supplying a crafted database that triggers flaws in the FTS5 full-text search extension when a MATCH query runs. The CVSS 4.0 vector indicates local attack vector with passive user interaction required, and no public exploit identified at time of analysis. Reported by VulnCheck with patches already merged upstream.

Technical ContextAI

SQLite is an embedded relational database engine used in countless applications, operating systems, browsers, and mobile devices. The vulnerability resides in the FTS5 (Full-Text Search version 5) virtual table module, which indexes text content into segments stored as B-tree-like pages. Two distinct CWE-122 (heap-based buffer overflow) class defects are present: an out-of-bounds read in fts5LeafSeek() driven by an attacker-controlled loop bound when parsing leaf page entries, and a heap buffer overflow write in fts5ChunkIterate() caused by an integer underflow when processing a crafted FTS5 continuation page. Both are reachable when the SQLite engine evaluates a MATCH operator against an FTS5 index inside a malicious database file, with the CPE cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* indicating all pre-3.53.2 SQLite distributions are in scope.

RemediationAI

Vendor-released patch: SQLite 3.53.2; upgrade the SQLite library used by the application or operating system to 3.53.2 or later, referencing the upstream commits at https://sqlite.org/src/info/061febcf41ca and https://sqlite.org/src/info/4a5ad516ea93 and the release notes at https://sqlite.org/releaselog/3_53_2.html. Where rebuilding/redeploying is not immediately possible, compensating controls include compiling SQLite with -DSQLITE_ENABLE_FTS5 omitted to remove the vulnerable code path entirely (side effect: any application feature relying on FTS5 MATCH queries will break), refusing to open SQLite databases originating from untrusted sources, and adding application-layer integrity checks (signature verification or checksum) on database files before opening them. For server-side databases the application controls end-to-end, restrict the attack surface by ensuring no untrusted user can supply or substitute the SQLite file used by the process.

More in Sqlite

View all
CVE-2015-5895 CRITICAL POC
10.0 Sep 18

Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a

CVE-2017-10989 CRITICAL
9.8 Jul 07

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles u

CVE-2025-6965 HIGH POC
7.2 Jul 15

Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggr

CVE-2019-5018 HIGH POC
8.1 May 10

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Rated high se

CVE-2018-20346 HIGH POC
8.1 Dec 21

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow)

CVE-2017-15286 HIGH POC
7.5 Oct 12

SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases wh

CVE-2022-35737 HIGH POC
7.5 Aug 03

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a

CVE-2021-36690 HIGH POC
7.5 Aug 24

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo functi

CVE-2020-13871 HIGH POC
7.5 Jun 06

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i

CVE-2020-11655 HIGH POC
7.5 Apr 09

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function

CVE-2023-7104 HIGH POC
7.3 Dec 29

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical.c of the component make alltest Hand

CVE-2022-46908 HIGH POC
7.3 Dec 12

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.122 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.142 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.142 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.136 Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-11822 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy