CVE-2026-11822

Name	CVE-2026-11822
Description	SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1139960

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sqlite3 (PTS)	bookworm	3.40.1-2+deb12u2	vulnerable
	trixie	3.46.1-7+deb13u2	fixed
	forky, sid	3.53.4-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
sqlite3	source	trixie	3.46.1-7+deb13u2
sqlite3	source	(unstable)	3.53.2-1			1139960

Notes

[bookworm] - sqlite3 <postponed> (Minor issue)
[bullseye] - sqlite3 <postponed> (Minor issue)
https://sqlite.org/src/info/061febcf41ca
https://sqlite.org/src/info/4a5ad516ea93