High severity · published Jun 9, 2026
CVE-2026-11824
SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
SQLite · SQLite
before 3.53.2 · source: vendor, NVD
RC
RUGGEDCOM CROSSBOW Station Access Controller (SAC) · Siemens
before V6.0 · source: CISA
In the news
VulnerabilityCritical
Siemens RUGGEDCOM CROSSBOW Station Access Controller
View CSAF
Summary
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.
The following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller are affected:
RUGGEDCOM CROSSBOW Station Access Controller (SAC) vers:intdot/<6.0 (CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824)
CVSS
Vendor
Equipment
v3 9.8
Siemens
RUGGEDCOM CROSSBOW Station Access Controller (SAC)
4 Vulnerabilities
Numeric Truncation Error, Improper Clearing of Heap Memory Before Release ('Heap Inspection'), Improper Handling of Unicode Encoding, Heap-based Buffer Overflow
Background
Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2025-6965
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption iss...
Oct 22, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11824
Release Notes
https://sqlite.org/releaselog/3_53_2.html
Issue Tracking
https://sqlite.org/src/info/061febcf41ca
Issue Tracking
https://sqlite.org/src/info/4a5ad516ea93
Third Party Advisory
https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-765416.html
More from SQLite
9.8
CVE-2025-3277
An integer overflow can be triggered in SQLite’s `concat_ws()` function
9.8
CVE-2020-35527
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause
9.8
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement
9.8
CVE-2019-19646
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns
9.8
CVE-2019-19317
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly…