8.5
High
CVE-2026-11824 SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that…
Description
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SQLite 3.53 | earliest → < 3.53.2 | 3.53.2 |
| RUGGEDCOM CROSSBOW Station Access Controller (SAC) 6.0 | earliest → < 6.0 | 6.0 |
References
- sqlite.org sqlite.org
- sqlite.org sqlite.org
- sqlite.org sqlite.org
- www.vulncheck.com www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of SQLite
The 18 CVEs of SQLite →
CVE-2026-119591
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
6.8
Medium
CVE-2026-119586
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits…
8.5
High
CVE-2026-119379
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in…
8.5
High
CVE-2026-119378
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make…
6.8
Medium