CVE-2026-11824

Vulnerability

SQLite versions prior to 3.53.2 contain a heap-based buffer overflow vulnerability within the FTS5 full-text search extension. This vulnerability is triggered when processing a crafted database with malicious continuation page metadata, specifically when the szLeaf value is less than 4. This leads to an integer underflow in fts5ChunkIterate(), inflating the remaining byte count during FTS5 MATCH query processing. The vulnerability requires applications to be compiled with SQLITE_ENABLE_FTS5 [3].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted database file to an application that uses the SQLite FTS5 extension. The attacker needs to ensure the database contains malicious continuation page metadata with a szLeaf value smaller than 4. When an FTS5 MATCH query is processed on this database, the integer underflow in fts5ChunkIterate() will occur, leading to the buffer overflow [3]. No specific network position, authentication, or user interaction is mentioned as required in the available references.

Impact

Successful exploitation of this vulnerability can lead to a heap buffer overflow of attacker-controlled data. This could result in a denial-of-service condition (crash) or allow an attacker to execute arbitrary code within the context of the affected application [3]. The scope of the compromise depends on the privileges of the application running SQLite.

Mitigation

The vulnerability is fixed in SQLite version 3.53.2, released on 2026-06-03 [1]. Users are advised to upgrade to this version or later. No workarounds are mentioned in the available references. SQLite versions prior to 3.53.2 are affected [3].