CVE-2026-11824: SQLite FTS5 Buffer Overflow Vulnerability

CVE-2026-11824 Overview

CVE-2026-11824 is a heap-based buffer overflow vulnerability in SQLite versions prior to 3.53.2. The flaw resides in the FTS5 full-text search extension, specifically in the fts5ChunkIterate() function. Attackers can trigger an integer underflow by supplying a crafted database containing malicious continuation page metadata with an szLeaf value smaller than 4. The underflow inflates the remaining byte counter during FTS5 MATCH query processing, producing a heap buffer overflow of attacker-controlled data. Exploitation requires the target application to be compiled with SQLITE_ENABLE_FTS5 and to open the malicious database file. Successful exploitation can crash the process or lead to arbitrary code execution within the SQLite host application.

Critical Impact

Attackers who can deliver a crafted SQLite database to a victim application built with FTS5 support can achieve arbitrary code execution in the context of that process.

Affected Products

• SQLite versions prior to 3.53.2
• Applications compiled with the SQLITE_ENABLE_FTS5 build option
• Software embedding vulnerable SQLite builds that process untrusted database files

Discovery Timeline

• 2026-06-09 - CVE-2026-11824 published to the National Vulnerability Database (NVD)
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-11824

Vulnerability Analysis

The vulnerability resides in the FTS5 full-text search extension shipped with SQLite. FTS5 stores indexed data across leaf and continuation pages, and each page header includes an szLeaf field that records the size of the leaf data region. The fts5ChunkIterate() routine reads szLeaf from a continuation page and uses it to compute how many remaining bytes belong to the current chunk. When szLeaf is smaller than 4, the subsequent subtraction underflows a size variable, producing an extremely large unsigned remaining byte count. SQLite then continues reading and copying attacker-controlled bytes past the bounds of the destination heap buffer, classified as a heap-based buffer overflow under [CWE-122]. The corruption occurs during normal MATCH query handling, so any application that runs a full-text query against the malicious database triggers the bug.

Root Cause

The root cause is missing validation of the szLeaf field on FTS5 continuation pages before it is used in pointer arithmetic. A value smaller than 4 violates an undocumented invariant and causes an integer underflow that drives an out-of-bounds heap write.

Attack Vector

The attack vector is local and requires user interaction: a victim must open or process an attacker-supplied SQLite database with an application compiled to include FTS5. Once an FTS5 MATCH query executes against the malicious file, the overflow occurs in the host process and can be steered toward code execution. Authentication is not required.

No verified public proof-of-concept code is available. Technical details are documented in the SQLite 3.53.2 release notes, the upstream commits 061febcf41ca and 4a5ad516ea93, and the VulnCheck advisory.

Detection Methods for CVE-2026-11824

Indicators of Compromise

• Unexpected crashes or SIGSEGV faults in processes that open SQLite databases and use FTS5 MATCH queries.
• Presence of untrusted .sqlite, .db, or .sqlite3 files in user-writable directories that contain FTS5 virtual tables with malformed page headers.
• Host processes embedding SQLite spawning child shells or making unexpected outbound network connections shortly after parsing a database file.

Detection Strategies

• Inventory all applications and libraries linked against SQLite and identify those built with SQLITE_ENABLE_FTS5; compare deployed versions against 3.53.2.
• Hunt for process crashes correlated with database file access using endpoint telemetry and Windows Error Reporting or Linux core dump records.
• Apply binary or file-format inspection to flag SQLite databases whose FTS5 page metadata contains szLeaf values smaller than 4.

Monitoring Recommendations

• Monitor child process creation and unusual memory regions in long-running services that ingest user-supplied SQLite files, such as messaging clients, browsers, and mobile sync agents.
• Alert on FTS5-enabled applications loading databases sourced from email attachments, downloads, or removable media.

How to Mitigate CVE-2026-11824

Immediate Actions Required

• Upgrade all SQLite installations and embedded copies to version 3.53.2 or later.
• Audit third-party software for bundled SQLite libraries and request vendor updates where the bundled version is older than 3.53.2.
• Block ingestion of untrusted SQLite database files at email, web, and file-sharing gateways until patching is complete.

Patch Information

SQLite resolved the issue in release 3.53.2. The relevant upstream fixes are tracked in commits 061febcf41ca and 4a5ad516ea93, which add validation of the szLeaf field before it is used in size calculations within fts5ChunkIterate(). Refer to the SQLite 3.53.2 release notes for the full changelog.

Workarounds

• Rebuild affected applications without the SQLITE_ENABLE_FTS5 compile-time flag if full-text search is not required.
• Restrict applications so they only open SQLite databases from trusted, integrity-verified sources.
• Run SQLite-consuming processes under reduced privileges and within sandboxes or containers to limit post-exploitation impact.

# Verify the linked SQLite version on a Linux host
sqlite3 --version

# Check whether FTS5 is compiled into the SQLite binary
sqlite3 :memory: "PRAGMA compile_options;" | grep -i FTS5