Executive brief
SQLite, a widely used database engine, contains a security flaw in its full-text search (FTS5) extension. An attacker could provide a specially crafted database file that, when opened and queried by an application, causes the application to crash or potentially allows the attacker to take control of the system. This risk is particularly relevant for applications that process untrusted database files from external sources.
Technical details
SQLite versions prior to 3.53.2 are vulnerable to memory corruption within the FTS5 full-text search extension. The issue stems from an out-of-bounds read in fts5LeafSeek() caused by an attacker-controlled loop bound and a heap-based buffer overflow in fts5ChunkIterate() resulting from an integer underflow in continuation page processing. An attacker can exploit these by providing a malformed database file; the vulnerability is triggered when an FTS5 MATCH query is executed against the malicious data. Successful exploitation can lead to arbitrary code execution or a denial-of-service (crash). Users should upgrade to SQLite 3.53.2 or later.
Affected products
- SQLite SQLite before 3.53.2
Timeline
- 2026-05-11: patched: Fixes committed to SQLite source tree
- 2026-06-03: advisory: SQLite 3.53.2 released
- 2026-06-09: disclosed: CVE-2026-11822 published