Skip to content
Fencer Vulns
high 7.8

CVE-2026-11824 json

SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate

published 2026-06-09 5 mo ago modified 2026-10-15 25 d ago also BIT-sqlite-2026-11824 , EUVD-2026-35801

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.

Patch / fix

  • bitnami sqlite 3.53.2
  • SQLite SQLite 3.53.2
  • Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) V6.0
  • sqlite3 Debian 13 3.46.1-7+deb13u2
  • sqlite3 Debian 14 3.53.2-1

debian advisories DEBIAN-CVE-2026-11824

  • sqlite3 Ubuntu 22.04 LTS 3.37.2-2ubuntu0.6
  • sqlite3 Ubuntu 24.04 LTS 3.45.1-1ubuntu2.6
  • sqlite3 Ubuntu 25.10 3.46.1-8ubuntu0.1
  • sqlite3 Ubuntu 26.04 LTS 3.46.1-9ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-11824

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sqlite RHEL 8 3.26.0-21.el8_10
  • lemon RHEL 8 3.26.0-21.el8_10
  • sqlite-libs RHEL 8 3.26.0-21.el8_10
  • sqlite RHEL 10.2 3.46.1-6.el10_2
  • sqlite-libs RHEL 10.2 3.46.1-6.el10_2
  • sqlite RHEL 9 3.34.1-11.el9_8
  • sqlite-libs RHEL 9 3.34.1-11.el9_8
  • npm RHEL 9 1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee

red hat advisories RHSA-2026:62416RHSA-2026:62236RHSA-2026:62232RHSA-2026:61697RHSA-2026:59956RHSA-2026:59024

  • sqlite3 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 3.53.2-150000.3.42.1
  • sqlite3 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.53.2-160000.1.1
  • sqlite3 Linux Micro 6.0 3.53.2-1.1
  • sqlite3 Linux Micro 6.1 3.53.2-slfo.1.1_1.1
  • sqlite3 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 3.53.2-9.50.1

suse advisories SUSE-SU-2026:2528-1SUSE-SU-2026:2527-1SUSE-SU-2026:22166-1SUSE-SU-2026:22218-1SUSE-SU-2026:22104-1SUSE-SU-2026:22134-1

  • sqlite3 openSUSE Leap 16.0 3.53.2-160000.1.1
  • sqlite3 openSUSE Tumbleweed 3.53.2-2.1

opensuse advisories openSUSE-SU-2026:21090-1openSUSE-SU-2026:11059-1

  • sqlite AlmaLinux 10 3.46.1-6.el10_2
  • sqlite-libs AlmaLinux 10 3.46.1-6.el10_2
  • sqlite AlmaLinux 9 3.34.1-11.el9_8
  • sqlite-libs AlmaLinux 9 3.34.1-11.el9_8
  • sqlite AlmaLinux 8 3.26.0-21.el8_10
  • lemon AlmaLinux 8 3.26.0-21.el8_10
  • sqlite-libs AlmaLinux 8 3.26.0-21.el8_10
  • npm AlmaLinux 9 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce

almalinux advisories ALSA-2026:58927ALSA-2026:58936ALSA-2026:58938ALSA-2026:55601ALSA-2026:55603ALSA-2026:54530

  • sqlite Rocky Linux 10 3.46.1-6.el10_2
  • nodejs Rocky Linux 9 1:22.23.1-3.module+el9.8.0+40280+057606e8
  • nodejs-nodemon Rocky Linux 9 3.1.14-2.module+el9.8.0+40264+d9b257bb
  • nodejs-nodemon Rocky Linux 9 3.1.14-2.module+el9.8.0+40280+057606e8
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40165+d075e3f2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.8.0+40164+8921ab53
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40153+4d595597

rocky linux advisories RLSA-2026:58927RLSA-2026:55601RLSA-2026:55603RLSA-2026:58936RLSA-2026:54371RLSA-2026:54530

  • sqlite Alpine 3.23 3.53.4-r0

alpine advisories ALPINE-CVE-2026-11824

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sqlite Azure Linux 3.0 3.44.0-4

azure linux advisories AZL-89703

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-11824 updated cvss 7.8

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

  • Red Hat Exploit Intelligence exploit-intelligence-tech-preview/agent-client-rhel9
    affected: workaround, no fix available
  • Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-neuron-rhel9, rhaiis/vllm-neuron-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 lemon, sqlite, sqlite-tcl
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rust, rhelai3/bootc-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, rhoai/odh-kueue-controller-rhel9, rhoai/odh-ml-pipelines-driver-rhel9, rhoai/odh-pipelines-components-rhel9, rhoai/odh-ml-pipelines-launcher-rhel9, +11 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-istio-csr-rhel9 1791378395, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82336
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19 cert-manager/cert-manager-operator-rhel9 1788348522, cert-manager/jetstack-cert-manager-rhel9 1788348571, cert-manager/cert-manager-istio-csr-rhel9 1788348594, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1788348571
    fixed: vendor fix RHSA-2026:63140
show 31 more
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-operator-rhel9 1790272426, cert-manager/cert-manager-operator-rhel9 1790589855, cert-manager/jetstack-cert-manager-rhel9 1790223279, cert-manager/jetstack-cert-manager-rhel9 1790589912, cert-manager/cert-manager-istio-csr-rhel9 1790223719, cert-manager/cert-manager-istio-csr-rhel9 1790589914, +2 more
    fixed: vendor fix RHSA-2026:72475
  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1787860580, rhaiis/vllm-cuda-rhel9 1790621718, rhaiis/vllm-rocm-rhel9 1787884873, rhaiis/vllm-rocm-rhel9 1790621713, rhaiis/model-opt-cuda-rhel9 1787772157, rhaiis/model-opt-cuda-rhel9 1790621714
    fixed: vendor fix RHSA-2026:73859
  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1789582776, rhaiis/vllm-rocm-rhel9 1789504371, rhaiis/vllm-spyre-rhel9 1789502493, rhaiis/model-opt-cuda-rhel9 1789508287
    fixed: vendor fix RHSA-2026:68696
  • Red Hat AI Inference Server 3.5 rhaii/vllm-cpu-rhel9 1791473614, rhaii/vllm-cuda-rhel9 1791473631, rhaii/vllm-rocm-rhel9 1791425869, rhaii/vllm-gaudi-rhel9 1791427182, rhaii/vllm-spyre-rhel9 1791818357, rhaii/model-opt-cuda-rhel9 1791803821
    fixed: vendor fix RHSA-2026:82066
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1788206196, discovery/discovery-server-rhel9 1788205779
    fixed: vendor fix RHSA-2026:61783
  • Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1790866732, rhelai3/bootc-rocm-rhel9 1790791893, rhelai3/bootc-aws-cuda-rhel9 1790936334, rhelai3/bootc-gcp-cuda-rhel9 1790936334, rhelai3/disk-image-cuda-rhel9 1790954179, rhelai3/bootc-azure-cuda-rhel9 1790936351, +1 more
    fixed: vendor fix RHSA-2026:76041
  • Red Hat Enterprise Linux AI 3.5 rhelai3/bootc-cuda-rhel9 1793135861, rhelai3/bootc-rocm-rhel9 1793135863, rhelai3/bootc-aws-cuda-rhel9 1793194817, rhelai3/bootc-gcp-cuda-rhel9 1793194815, rhelai3/disk-image-cuda-rhel9 1793206758, rhelai3/bootc-azure-cuda-rhel9 1793194815, +1 more
    fixed: vendor fix RHSA-2026:92452
  • Red Hat Enterprise Linux AppStream (v. 8) lemon 3.26.0-21.el8_10, nodejs 22.23.1-3.module+el8.10.0+24640+6eba5e6e, nodejs 24.18.0-3.module+el8.10.0+24639+56878497, nodejs-libs 22.23.1-3.module+el8.10.0+24640+6eba5e6e, nodejs-libs 24.18.0-3.module+el8.10.0+24639+56878497, npm 10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e, +9 more
    fixed: vendor fix RHSA-2026:58938
  • Red Hat Enterprise Linux AppStream (v. 9) sqlite 3.34.1-11.el9_8, nodejs 22.23.1-3.module+el9.8.0+24637+e0b636e5, nodejs 24.18.0-6.module+el9.8.0+24638+75f46aee, nodejs-libs 22.23.1-3.module+el9.8.0+24637+e0b636e5, nodejs-libs 24.18.0-6.module+el9.8.0+24638+75f46aee, npm 10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5, +9 more
    fixed: vendor fix RHSA-2026:58936
  • Red Hat Enterprise Linux AppStream (v. 10) sqlite 3.46.1-6.el10_2
    fixed: vendor fix RHSA-2026:58927
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) lemon 3.26.0-13.el8_4.2
    fixed: vendor fix RHSA-2026:59024
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) lemon 3.26.0-16.el8_6.4
    fixed: vendor fix RHSA-2026:59020
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) lemon 3.26.0-18.el8_8.3
    fixed: vendor fix RHSA-2026:58939
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) sqlite 3.34.1-6.el9_2.3
    fixed: vendor fix RHSA-2026:62232
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) sqlite 3.34.1-7.el9_4.2
    fixed: vendor fix RHSA-2026:62236
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) sqlite 3.46.1-5.el10_0.1
    fixed: vendor fix RHSA-2026:61697
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) sqlite 3.34.1-8.el9_6.1, nodejs 22.23.2-1.module+el9.6.0+24769+299a7e3a, nodejs-libs 22.23.2-1.module+el9.6.0+24769+299a7e3a, npm 10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a, nodejs-nodemon 3.1.14-2.module+el9.6.0+24789+4011c12f, nodejs-full-i18n 22.23.2-1.module+el9.6.0+24769+299a7e3a, +2 more
    fixed: vendor fix RHSA-2026:59956
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) lemon 3.26.0-13.el8_4.2
    fixed: vendor fix RHSA-2026:59024
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) lemon 3.26.0-16.el8_6.4
    fixed: vendor fix RHSA-2026:59020
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) lemon 3.26.0-18.el8_8.3
    fixed: vendor fix RHSA-2026:58939
  • Red Hat Enterprise Linux BaseOS (v. 8) sqlite 3.26.0-21.el8_10, sqlite-libs 3.26.0-21.el8_10
    fixed: vendor fix RHSA-2026:58938
  • Red Hat Enterprise Linux BaseOS (v. 9) sqlite 3.34.1-11.el9_8, sqlite-libs 3.34.1-11.el9_8
    fixed: vendor fix RHSA-2026:58936
  • Red Hat Enterprise Linux BaseOS (v. 10) sqlite 3.46.1-6.el10_2, sqlite-libs 3.46.1-6.el10_2
    fixed: vendor fix RHSA-2026:58927
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) sqlite 3.26.0-13.el8_4.2, sqlite-libs 3.26.0-13.el8_4.2
    fixed: vendor fix RHSA-2026:59024
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) sqlite 3.26.0-16.el8_6.4, sqlite-libs 3.26.0-16.el8_6.4
    fixed: vendor fix RHSA-2026:59020
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) sqlite 3.26.0-18.el8_8.3, sqlite-libs 3.26.0-18.el8_8.3
    fixed: vendor fix RHSA-2026:58939
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) sqlite 3.34.1-6.el9_2.3, sqlite-libs 3.34.1-6.el9_2.3
    fixed: vendor fix RHSA-2026:62232
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) sqlite 3.34.1-7.el9_4.2, sqlite-libs 3.34.1-7.el9_4.2
    fixed: vendor fix RHSA-2026:62236
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) sqlite 3.46.1-5.el10_0.1, sqlite-libs 3.46.1-5.el10_0.1
    fixed: vendor fix RHSA-2026:61697
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) sqlite 3.34.1-8.el9_6.1, sqlite-libs 3.34.1-8.el9_6.1
    fixed: vendor fix RHSA-2026:59956
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) sqlite 3.26.0-13.el8_4.2, sqlite-libs 3.26.0-13.el8_4.2
    fixed: vendor fix RHSA-2026:59024

17 more fixed, 8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-15 updated cvss 7.8

Siemens RUGGEDCOM CROSSBOW Station Access Controller

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
bitnami sqlite
<3.53.2
3.53.2

Affected products

  • SQLite SQLite
  • Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC)

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.