CVE-2026-11822: SQLite before 3.53.2 Memory Corruption in FTS5 Extension

Synopsis

Memory corruption vulnerabilities in the FTS5 full-text search extension of SQLite before 3.53.2 allow an attacker to trigger an out-of-bounds read and a heap buffer overflow write by supplying a crafted database file with malformed FTS5 page data. The attack is local and requires no authentication, but a user or process must execute an FTS5 MATCH query against the attacker-controlled database. Successful exploitation enables arbitrary code execution, process crashes, or memory exhaustion within the affected process. A patched-image rebuild at SQLite 3.53.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationNot required

  No credentials or account are needed; the attack is triggered by supplying a crafted database file to any process that opens it.

• Victim interactionRequired

  A user or automated process must execute an FTS5 MATCH query against the attacker-supplied database, making some degree of social engineering or file-planting necessary.

• Attack complexityDetail

  The exploit is reliable and condition-free once the malicious database is in place; no race conditions or specific memory layout requirements are noted.

Blast Radius

• Arbitrary code execution is achievable within the process that opens the malicious database, giving the attacker control over that process's execution context.
• The heap buffer overflow write and out-of-bounds read allow the attacker to read and overwrite process memory, exposing in-memory secrets such as session tokens or cached query results.
• The affected process can be crashed outright, disrupting any service or application that depends on SQLite for storage.
• Memory exhaustion can be induced, degrading or halting the host application without a clean crash signal.