CVE-2026-11822Published

SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek

Exact source revision recorded 30 Oct 2026 02:48:55 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-11822

Published

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.

Source published: 9 Jun 2026 19:08:31 UTC
Source modified: 30 Oct 2026 01:22:48 UTC
Observed here: 30 Oct 2026 02:48:55 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS 4.0 · 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N