SQLite FTS5 Heap Buffer Overflow Patched in CVE-2026-11824
Vulnerability Disclosure · 6 sources · Updated 2mo ago · First seen Jul 10, 2026
SQLite patched CVE-2026-11824, a high-severity heap buffer overflow in the FTS5 full-text search extension, in release 3.53.2. The flaw stems from an integer underflow in fts5ChunkIterate() and affects SQLite versions prior to 3.53.2 when compiled with SQLITE_ENABLE_FTS5. According to public reporting and SQLite's vulnerability listings, the bug can be triggered when an application opens a crafted database file and runs an FTS5 MATCH query.
Successful exploitation could cause a denial of service and may enable arbitrary code execution in affected applications. The issue requires specific conditions—most notably that the target accepts an untrusted SQLite database and uses FTS5 search features—but SQLite's broad use across software and embedded products makes the exposure significant. SQLite addressed the bug with fixes incorporated before the 3.53.2 release and published the update in its official release log and CVE documentation.
