High severity · published Jun 9, 2026
CVE-2026-11822
SQLite before 3.53.2 Memory Corruption in FTS5 Extension
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
SQLite · SQLite
before 3.53.2 · source: vendor, NVD
RC
RUGGEDCOM CROSSBOW Station Access Controller (SAC) · Siemens
before V6.0 · source: CISA
In the news
VulnerabilityCritical
Siemens RUGGEDCOM CROSSBOW Station Access Controller
View CSAF
Summary
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.
The following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller are affected:
RUGGEDCOM CROSSBOW Station Access Controller (SAC) vers:intdot/<6.0 (CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824)
CVSS
Vendor
Equipment
v3 9.8
Siemens
RUGGEDCOM CROSSBOW Station Access Controller (SAC)
4 Vulnerabilities
Numeric Truncation Error, Improper Clearing of Heap Memory Before Release ('Heap Inspection'), Improper Handling of Unicode Encoding, Heap-based Buffer Overflow
Background
Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2025-6965
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption iss...
Oct 22, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11822
Release Notes
https://sqlite.org/releaselog/3_53_2.html
Issue Tracking
https://sqlite.org/src/info/061febcf41ca
Issue Tracking
https://sqlite.org/src/info/4a5ad516ea93
Third Party Advisory
https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-765416.html
More from SQLite
9.8
CVE-2025-3277
An integer overflow can be triggered in SQLite’s `concat_ws()` function
9.8
CVE-2020-35527
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause
9.8
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement
9.8
CVE-2019-19646
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns
9.8
CVE-2019-19317
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly…