Skip to content

CVE-2026-11822 on CTRL-OS 26.05

Aliases: CVE-2026-11822

Packages: sqlite

Status: Plausible

Advisory Information

SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.

Updates

2026-07-20 20:10 CEST

Metadata changes:

  • Status for package sqlite: “Plausible”

2026-06-17 22:02 CEST

Metadata changes:

  • Status for package sqlite: “New”