Loading story…
Google Project Zero reported that its Big Sleep large language model identified a previously unknown vulnerability in SQLite, marking a real-world bug discovery during testing on widely used open-source software. The flaw affects SQLite 3.47.0 and was traced to the seriesBestIndex function, where improper handling of rowid-related parameters can allow an invalid negative iColumn value.
The bug causes a stack buffer underflow that can lead to out-of-bounds heap writes, creating conditions that may be exploitable for attacks. According to reporting cited by CSIRT.SK, the issue had not been caught by existing fuzzing tools, underscoring the significance of AI-assisted vulnerability research; defenders were advised to update SQLite to the latest available version.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that the newly disclosed SQLite vulnerability affects SQLite 3.47.0 and said the issue had been missed by fuzzing tools. Its notice recommended updating to the latest SQLite version.
Google Project Zero published a report describing how its Big Sleep large language model found a previously undiscovered vulnerability in SQLite while testing real-world open-source software. The flaw was characterized as a stack buffer underflow that can lead to out-of-bounds heap writes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed that a crafted **SQLite** database can be weaponized to achieve code execution by exploiting memory-corruption flaws in the SQLite engine itself, even when an application only performs hardcoded queries against untrusted data. The researchers described two techniques—**Query Hijacking** and **Query Oriented Programming (QOP)**—that abuse schema elements such as `VIEW`s and virtual-table features to redirect execution into attacker-controlled paths without requiring a surrounding scripting environment. The report demonstrated the approach in two practical scenarios: remote code execution against a PHP7-based password-stealer backend and privileged persistence on **iOS** by replacing a frequently queried SQLite database. The research also pointed to risky virtual-table modules including **FTS** and **RTREE**, referenced earlier issues such as `CVE-2015-7036` and `CVE-2019-8457`, and said Apple assigned `CVE-2019-8600`, `CVE-2019-8598`, `CVE-2019-8602`, and `CVE-2019-8577` after responsible disclosure.
Aug 14, 2026
SQLite patched **CVE-2026-11824**, a high-severity heap buffer overflow in the `FTS5` full-text search extension, in release **3.53.2**. The flaw stems from an integer underflow in `fts5ChunkIterate()` and affects SQLite versions prior to 3.53.2 when compiled with `SQLITE_ENABLE_FTS5`. According to public reporting and SQLite's vulnerability listings, the bug can be triggered when an application opens a crafted database file and runs an `FTS5 MATCH` query. Successful exploitation could cause a denial of service and may enable arbitrary code execution in affected applications. The issue requires specific conditions—most notably that the target accepts an untrusted SQLite database and uses `FTS5` search features—but SQLite's broad use across software and embedded products makes the exposure significant. SQLite addressed the bug with fixes incorporated before the 3.53.2 release and published the update in its official release log and CVE documentation.
Aug 27, 2026
MITRE rejected a batch of CVE reports affecting **SQLite**, **libraw**, and **ESP32-audioI2S** after researchers found the underlying claims were likely fabricated. An `oss-sec` post cited JFrog's review of recently published SQLite advisories and said some records had briefly appeared on **cve.org** before being withdrawn, underscoring how CVE Numbering Authorities often depend on submitter accuracy and may not be able to independently validate every report before publication. JFrog said six SQLite entries—`CVE-2026-51302`, `CVE-2026-51303`, `CVE-2026-51300`, `CVE-2026-51297`, `CVE-2026-51296`, and `CVE-2026-51304`—contained major inconsistencies, including references to nonexistent functions, invalid SQL, impossible code paths, mismatched line numbers, and proof-of-concept payloads that did not reproduce crashes. The researchers traced the advisories to a newly created GitHub repository and concluded they were largely AI-generated "LLM slop"; in a broader audit of 55 advisories from the same account, they found 54 appeared fabricated and one described a real bug but with unverified CVE metadata, raising concerns that false high-severity entries can pollute NVD and CISA enrichment pipelines and mislead automated vulnerability triage.
Aug 5, 2026