Memory Corruption Vulnerability in SQLite FTS5 Full-Text Search Extension

CVE-2026-11822

What is CVE-2026-11822?

The FTS5 full-text search extension in SQLite prior to version 3.53.2 is susceptible to memory corruption issues. Attackers can exploit these vulnerabilities by providing a specially crafted database containing malformed FTS5 page data. This can lead to process crashes, memory exhaustion, or even arbitrary code execution. The vulnerabilities include an out-of-bounds read triggered in the fts5LeafSeek() function and a heap buffer overflow in fts5ChunkIterate(). Successful exploitation occurs when an attacker executes a MATCH query against the malicious database, making systems vulnerable if not promptly patched.

References