CVE-2026-11822: SQLite FTS5 Memory Corruption Vulnerability – Patch Guidance

Technical summary

The vulnerability encompasses two distinct memory corruption issues within FTS5: (1) an out-of-bounds read in fts5LeafSeek() caused by an attacker-controlled loop boundary, and (2) a heap buffer overflow write in fts5ChunkIterate() resulting from integer underflow when processing malformed continuation pages. Both flaws are triggered when an FTS5 MATCH query is executed against a database containing crafted FTS5 page structures. The root cause is insufficient validation of FTS5 index metadata and page layout during query execution.

Business impact

Organizations relying on SQLite—including embedded systems, mobile applications, desktop software, and IoT devices—face potential service disruption or data compromise. The local attack vector and requirement for user interaction limit mass exploitation, but targeted attacks against high-value systems remain plausible. Affected software may appear to malfunction unexpectedly, hindering troubleshooting and creating support burden.

Affected systems

SQLite versions before 3.53.2 are affected when the FTS5 extension is compiled in and in use. This includes most default SQLite installations, as FTS5 is commonly enabled. End products vulnerable include browsers, mail clients, messaging applications, office suites, database management tools, and any software embedding SQLite. Verify your software's specific SQLite version and whether FTS5 is enabled in your deployment.

Exploitability

The vulnerability requires local access and user interaction—the victim must open a malicious database file. This limits opportunistic, remote exploitation but remains practical for targeted attacks via email attachments, removable media, or compromised downloads. Once triggered via a MATCH query, the memory corruption is reliable and immediate. The barrier to exploit development is low given the straightforward trigger mechanism.

Remediation

Upgrade SQLite to version 3.53.2 or later. For software vendors bundling SQLite, check upstream updates and plan patching cycles accordingly. Organizations should prioritize updates for systems handling untrusted database files or user-supplied data. Until patching is complete, avoid opening SQLite databases from untrusted sources, particularly via applications using FTS5 functionality.

Patch guidance

Apply SQLite version 3.53.2 or later. For operating systems and distributions, monitor vendor advisories for bundled updates. For embedded and proprietary applications, contact the vendor for availability and timelines. Test patches in non-production environments to ensure compatibility with existing database files and application behavior. Consider staged rollout if SQLite updates coincide with other system changes.

Detection guidance

Monitor system logs for unexpected application crashes or segmentation faults in processes using SQLite. Endpoint detection and response (EDR) tools can flag unusual memory access patterns or process terminations tied to FTS5 queries. Network monitoring is less applicable given the local attack vector. Forensically, examine recently accessed or transferred database files (.db, .sqlite, etc.) for signs of suspicious origin or modification timestamps correlating with incidents.

Why prioritize this

A CVSS 7.8 (HIGH) severity score reflects the combination of high impact (code execution, data compromise) and ease of triggering via a local file interaction. The vulnerability is not yet tracked as actively exploited in the wild, but the low exploit complexity and prevalence of SQLite across consumer and enterprise software make this a near-term risk. Organizations handling sensitive data or operating user-facing applications should prioritize patching.

Risk score, explained

The score of 7.8 is justified by: (1) HIGH impact potential—memory corruption can lead to arbitrary code execution or confidentiality/integrity loss; (2) LOW attack complexity—no special privileges or network access needed, only local file access and query execution; (3) REQUIRED user interaction—a user must open a malicious database, reducing but not eliminating risk in scenarios involving social engineering or automatic file processing; (4) LOW privilege requirement—the attacker does not need elevated permissions on the target system.

Frequently asked questions