Loading story…
SQLite patched CVE-2026-11824, a high-severity heap buffer overflow in the FTS5 full-text search extension, in release 3.53.2. The flaw stems from an integer underflow in fts5ChunkIterate() and affects SQLite versions prior to 3.53.2 when compiled with SQLITE_ENABLE_FTS5. According to public reporting and SQLite's vulnerability listings, the bug can be triggered when an application opens a crafted database file and runs an FTS5 MATCH query.
Successful exploitation could cause a denial of service and may enable arbitrary code execution in affected applications. The issue requires specific conditions—most notably that the target accepts an untrusted SQLite database and uses FTS5 search features—but SQLite's broad use across software and embedded products makes the exposure significant. SQLite addressed the bug with fixes incorporated before the 3.53.2 release and published the update in its official release log and CVE documentation.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Unity Linux published advisory UTSA-2026-104747 for Unity Linux 20 systems with affected SQLite packages, remediating CVE-2026-11824 by updating SQLite to a fixed version. The advisory notes the flaw affects FTS5-enabled applications using SQLite versions before 3.53.2.
SQLite's vulnerabilities page included CVE-2026-11824 among documented security issues affecting the project.
ZeroPath published a technical analysis of CVE-2026-11824 describing the bug as a high-severity heap buffer overflow reachable by opening a crafted database and executing an FTS5 MATCH query, with possible denial of service or arbitrary code execution.
SQLite released version 3.53.2, which patched CVE-2026-11824, a heap buffer overflow in the FTS5 full-text search extension affecting versions prior to 3.53.2 when built with SQLITE_ENABLE_FTS5.
SQLite added fix commits addressing an integer underflow in the FTS5 function fts5ChunkIterate(), the flaw later tracked as CVE-2026-11824. The ZeroPath analysis also notes a regression test was published in the official source tree.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcesqlite.org
Open sourcezeropath.com
Open sourcesqlite.org
Open sourcesqlite.org
Open sourcesqlite.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed that a crafted **SQLite** database can be weaponized to achieve code execution by exploiting memory-corruption flaws in the SQLite engine itself, even when an application only performs hardcoded queries against untrusted data. The researchers described two techniques—**Query Hijacking** and **Query Oriented Programming (QOP)**—that abuse schema elements such as `VIEW`s and virtual-table features to redirect execution into attacker-controlled paths without requiring a surrounding scripting environment. The report demonstrated the approach in two practical scenarios: remote code execution against a PHP7-based password-stealer backend and privileged persistence on **iOS** by replacing a frequently queried SQLite database. The research also pointed to risky virtual-table modules including **FTS** and **RTREE**, referenced earlier issues such as `CVE-2015-7036` and `CVE-2019-8457`, and said Apple assigned `CVE-2019-8600`, `CVE-2019-8598`, `CVE-2019-8602`, and `CVE-2019-8577` after responsible disclosure.
Aug 14, 2026
Google Project Zero reported that its **Big Sleep** large language model identified a previously unknown vulnerability in **SQLite**, marking a real-world bug discovery during testing on widely used open-source software. The flaw affects `SQLite 3.47.0` and was traced to the `seriesBestIndex` function, where improper handling of `rowid`-related parameters can allow an invalid negative `iColumn` value. The bug causes a **stack buffer underflow** that can lead to **out-of-bounds heap writes**, creating conditions that may be exploitable for attacks. According to reporting cited by CSIRT.SK, the issue had not been caught by existing fuzzing tools, underscoring the significance of AI-assisted vulnerability research; defenders were advised to update SQLite to the latest available version.
Jul 24, 2026
Researchers disclosed an **integer wraparound/overflow** flaw in PostgreSQL’s *libpq* client library (tracked as **CVE-2025-12818**) that can be triggered via the `PQescapeInternal` code path used by `PQescapeLiteral` and `PQescapeIdentifier`. When a crafted input string of certain lengths includes quotes and/or backslashes, *libpq* can miscalculate the required buffer size, allocate too little memory, and then perform an **out-of-bounds write by hundreds of megabytes**, typically resulting in a **segmentation fault (DoS)** in the consuming application. F5’s product advisories state that PostgreSQL versions prior to **18.1, 17.7, 16.11, 15.15, 14.20, and 13.23** are affected by CVE-2025-12818, but report **no impact to F5 products** after evaluation. Separate F5 advisories published alongside this disclosure cover unrelated issues, including a PostgreSQL authorization/DoS issue in `CREATE STATISTICS` (**CVE-2025-12817**), a curl cross-protocol redirect token-leak issue (**CVE-2025-14524**), an Apache Solr *create core* input-validation/allowPaths bypass with potential NTLM hash disclosure on Windows (**CVE-2026-22444**), and a local privilege-escalation issue in the Intel 800 Series Ethernet Linux driver affecting certain F5 appliance lines (**CVE-2025-24325**).
Jun 29, 2026