--- id: CVE-2026-11822 title: >- SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with mal… summary: >- SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with mal… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-122 - CWE-125 vendor: sqlite product: sqlite affected: - sqlite < 3.53.2 patched: - sqlite 3.53.2 published: '2026-06-09' updated: '2026-10-15' sourceUpdated: '2026-10-15T02:18:37.480' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11822' references: - url: 'https://sqlite.org/releaselog/3_53_2.html' label: disclosure@vulncheck.com - url: 'https://sqlite.org/src/info/061febcf41ca' label: disclosure@vulncheck.com - url: 'https://sqlite.org/src/info/4a5ad516ea93' label: disclosure@vulncheck.com - url: >- https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension label: disclosure@vulncheck.com - url: 'https://cert-portal.siemens.com/productcert/html/ssa-765416.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11822.json - url: 'https://access.redhat.com/security/cve/CVE-2026-11822' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487258' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-11822' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11822' - url: 'https://access.redhat.com/errata/RHSA-2026:65907' - url: 'https://access.redhat.com/errata/RHSA-2026:65839' - url: 'https://access.redhat.com/errata/RHSA-2026:73866' - url: 'https://access.redhat.com/errata/RHSA-2026:67935' - url: 'https://access.redhat.com/errata/RHSA-2026:70586' - url: 'https://access.redhat.com/errata/RHSA-2026:65851' - url: 'https://access.redhat.com/errata/RHSA-2026:61697' - url: 'https://access.redhat.com/errata/RHSA-2026:58927' - url: 'https://access.redhat.com/errata/RHSA-2026:58938' - url: 'https://access.redhat.com/errata/RHSA-2026:54530' - url: 'https://access.redhat.com/errata/RHSA-2026:54371' - url: 'https://access.redhat.com/errata/RHSA-2026:59024' - url: 'https://access.redhat.com/errata/RHSA-2026:59020' - url: 'https://access.redhat.com/errata/RHSA-2026:58939' - url: 'https://access.redhat.com/errata/RHSA-2026:62232' - url: 'https://access.redhat.com/errata/RHSA-2026:62236' - url: 'https://access.redhat.com/errata/RHSA-2026:59956' - url: 'https://access.redhat.com/errata/RHSA-2026:62416' - url: 'https://access.redhat.com/errata/RHSA-2026:58936' - url: 'https://access.redhat.com/errata/RHSA-2026:55601' - url: 'https://access.redhat.com/errata/RHSA-2026:55603' - url: 'https://sqlite.org/src/info/87b653731171' - url: 'https://sqlite.org/src/info/fad98805b7d7' tags: - nvd - cve.org - csaf - vex - red-hat - score-dispute epss: 0.00364 epssPercentile: 0.30038 ingestedAt: '2026-10-15T03:30:12.900Z' ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-06-09T20:01:49.623614Z' scores: nvd: 7.8 cna: 5.5 --- ## Overview SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database. ## Affected - `sqlite < 3.53.2` ## Remediation Upgrade past the affected range: - `sqlite 3.53.2` ## Vendor advisories - **RHSA-2026:65907** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65907) - **RHSA-2026:65839** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65839) - **RHSA-2026:73866** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:73866) - **RHSA-2026:67935** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:67935) - **RHSA-2026:70586** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:70586) - **RHSA-2026:65851** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65851) - **RHSA-2026:61697** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61697) - **RHSA-2026:58927** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58927) - **RHSA-2026:58938** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58938) - **RHSA-2026:54530** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54530) - **RHSA-2026:54371** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54371) - **Red Hat VEX** · Important · affected: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Enterprise Linux 6, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11822.json)