CVE-2026-11822

Name of the Vulnerable Software and Affected Versions SQLite versions prior to 3.53.2

Description Memory corruption issues exist in the FTS5 full-text search extension. An attacker can cause process crashes, memory exhaustion, or arbitrary code execution by providing a crafted database containing malformed FTS5 page data. This is exploitable when an FTS5 MATCH query is executed against the malicious database. Technical details include an out-of-bounds read in the fts5LeafSeek() function via an attacker-controlled loop bound, and a heap buffer overflow write in the fts5ChunkIterate() function caused by an integer underflow through a crafted continuation page.

Recommendations Update to version 3.53.2 or later.