CVE-2026-11824

Katalog CVE

CVSS 7.8 · High EPSS 0,18%

Kerentanan Heap-based Buffer Overflow pada sqlite. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.

Rincian

Terbit di NVD

9 Juni 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sqlite.org/src/info/061febcf41ca issue tracking · patch
• https://sqlite.org/src/info/4a5ad516ea93 issue tracking · patch
• https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate advisory pihak ketiga
• https://sqlite.org/releaselog/3_53_2.html release notes