CVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate
Attackers can execute arbitrary code or cause crashes in applications using SQLite with FTS5 enabled by providing a crafted database file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-11824?
CVE-2026-11824 is a high-severity memory corruption vulnerability in Sqlite Sqlite, published on 9 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
Weakness: CWE-122
Which versions are affected by CVE-2026-11824?
1 open source package ship an affected version, including sqlite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sqlite Bitnami | All versions | 3.53.2 |
Products include Sqlite Sqlite.
How do I fix CVE-2026-11824?
Upgrade sqlite to 3.53.2 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-11824 being exploited?
There is no known exploitation of CVE-2026-11824 in the wild and no public exploit code.
Other vulnerabilities in Sqlite Sqlite
Sources
Also known as ALPINE-CVE-2026-11824, AZL-89703, BELL-CVE-2026-11824, BIT-sqlite-2026-11824, DEBIAN-CVE-2026-11824, ECHO-3be4-5309-fe51 and 10 more.