CVE-2026-11824

Name of the Vulnerable Software and Affected Versions SQLite versions prior to 3.53.2

Description A heap-based buffer overflow exists in the FTS5 full-text search extension. An attacker can cause a crash or execute arbitrary code by providing a crafted database containing malicious continuation page metadata with a szLeaf value smaller than 4. This triggers an integer underflow in the fts5ChunkIterate() function, resulting in an inflated remaining byte count during FTS5 MATCH query processing. This issue affects applications compiled with SQLITE ENABLE FTS5.

Recommendations Update to version 3.53.2 or later.