5.5
Medium
CVE-2026-11822 SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows…
Description
SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SQLite 3.53 | earliest → < 3.53.2 | 3.53.2 |
| RUGGEDCOM CROSSBOW Station Access Controller (SAC) 6.0 | earliest → < 6.0 | 6.0 |
References
- sqlite.org sqlite.org
- sqlite.org sqlite.org
- sqlite.org sqlite.org
- www.vulncheck.com www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of SQLite
The 18 CVEs of SQLite →
CVE-2026-119591
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
6.8
Medium
CVE-2026-119586
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits…
8.5
High
CVE-2026-119379
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in…
8.5
High
CVE-2026-119378
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make…
6.8
Medium