Skip to main content

SQLite CVE-2026-11824

| EUVDEUVD-2026-35801 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-09 VulnCheck GHSA-8g48-4wfm-7247
8.5
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

5
Analysis Updated
Jun 09, 2026 - 20:43 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 09, 2026 - 20:42 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 09, 2026 - 20:22 vuln.today
cvss_changed
CVSS changed
Jun 09, 2026 - 20:22 NVD
7.8 (HIGH) 8.5 (HIGH)
Analysis Generated
Jun 09, 2026 - 20:09 vuln.today

DescriptionCVE.org

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.

AnalysisAI

Heap-based buffer overflow in SQLite's FTS5 full-text search extension (versions before 3.53.2) allows attackers to crash the process or execute arbitrary code by supplying a malicious database file that triggers an integer underflow in fts5ChunkIterate() during MATCH query processing. The flaw affects any application compiled with SQLITE_ENABLE_FTS5 that opens an attacker-supplied database and runs an FTS5 query against it; no public exploit identified at time of analysis, though VulnCheck has published an advisory.

Technical ContextAI

SQLite's FTS5 module implements full-text indexing by storing inverted-index data across segment B-trees whose leaf pages carry a szLeaf metadata field indicating the size of the leaf's term payload. The fts5ChunkIterate() routine walks continuation pages following a leaf and uses szLeaf to compute the remaining byte count of the chunk. When szLeaf is less than 4, an unchecked subtraction underflows a size_t/integer counter, producing an extremely large 'remaining' value that subsequent copy/read loops treat as legitimate - the canonical CWE-122 heap-based buffer overflow pattern, here reached via untrusted page metadata rather than untrusted query text. Affected CPE is cpe:2.3:a:sqlite:sqlite:*, meaning the bug lives in the upstream amalgamation and propagates to every embedder (browsers, mobile OSes, language stdlibs, desktop apps) that links a vulnerable SQLite with FTS5 enabled, which is the default in most distributions.

RemediationAI

Upgrade SQLite to version 3.53.2 or later, which contains the upstream fixes tracked at https://sqlite.org/src/info/061febcf41ca and https://sqlite.org/src/info/4a5ad516ea93; consult https://sqlite.org/releaselog/3_53_2.html for full release notes. For embedders that cannot immediately rebuild, the most effective compensating control is to recompile without SQLITE_ENABLE_FTS5 if FTS5 is not used, which eliminates the vulnerable code path at the cost of breaking any application feature that depends on full-text search. Where FTS5 must remain enabled, restrict the application to opening only databases produced by trusted code paths and refuse to attach or import user-supplied .db/.sqlite files; if user-supplied databases are unavoidable, validate them by opening read-only and avoiding MATCH queries against untrusted FTS5 indexes, accepting that this materially reduces search functionality.

More in Sqlite

View all
CVE-2015-5895 CRITICAL POC
10.0 Sep 18

Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a

CVE-2017-10989 CRITICAL
9.8 Jul 07

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles u

CVE-2025-6965 HIGH POC
7.2 Jul 15

Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggr

CVE-2026-11822 HIGH POC
8.5 Jun 09

Memory corruption in SQLite versions before 3.53.2 enables attackers to crash processes, exhaust memory, or potentially

CVE-2019-5018 HIGH POC
8.1 May 10

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Rated high se

CVE-2018-20346 HIGH POC
8.1 Dec 21

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow)

CVE-2017-15286 HIGH POC
7.5 Oct 12

SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases wh

CVE-2022-35737 HIGH POC
7.5 Aug 03

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a

CVE-2021-36690 HIGH POC
7.5 Aug 24

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo functi

CVE-2020-13871 HIGH POC
7.5 Jun 06

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i

CVE-2020-11655 HIGH POC
7.5 Apr 09

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function

CVE-2023-7104 HIGH POC
7.3 Dec 29

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical.c of the component make alltest Hand

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.122 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.142 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.142 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.136 Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-11824 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy