CVE-2026-11822: SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek
Last updated 29 June 2026
Other sources
SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITEENABLEFTS5.
— MITRE
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.
— Launchpad
SQLite before 3.53.2 Memory Corruption in FTS5 Extension
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.44.0-4 - Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.46.1-7+deb13u2Fixed in 3.53.4-2 - Upgrade
Upgrade
alpine/sqliteto a version that resolves this vulnerability.Fixed in 3.53.4-r0 - Upgrade
Upgrade
ubuntu/sqlite3to a version that resolves this vulnerability.Fixed in 3.37.2-2ubuntu0.6 - Upgrade
Upgrade
ubuntu/sqlite3to a version that resolves this vulnerability.Fixed in 3.45.1-1ubuntu2.6 - Upgrade
Upgrade
ubuntu/sqlite3to a version that resolves this vulnerability.Fixed in 3.46.1-8ubuntu0.1 - Upgrade
Upgrade
ubuntu/sqlite3to a version that resolves this vulnerability.Fixed in 3.46.1-9ubuntu0.1 - Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.46.1-7+deb13u2 - Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.53.2-1 - Upgrade
Upgrade
bitnami/sqliteto a version that resolves this vulnerability.Fixed in 3.53.2 - Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.53.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11822?
CVE-2026-11822 has a high severity rating of 8.5.
How do I fix CVE-2026-11822?
To fix CVE-2026-11822, upgrade your SQLite version to 3.53.2 or later.
What impacts does CVE-2026-11822 have?
CVE-2026-11822 can lead to process crashes, memory exhaustion, or arbitrary code execution.
Who is affected by CVE-2026-11822?
SQLite versions before 3.53.2 are affected by CVE-2026-11822.
What component of SQLite is vulnerable in CVE-2026-11822?
The vulnerability in CVE-2026-11822 is found in the FTS5 full-text search extension of SQLite.