SQLite FTS5 Memory Corruption: Quick Look at CVE-2026-11822 and Its Billion-Device Attack Surface

Introduction

Two memory corruption bugs in SQLite's FTS5 full-text search extension can be chained to leak heap data and then overwrite heap memory. That chain could lead to arbitrary code execution when an application does nothing more than run a search query against a crafted database file. SQLite is embedded in every Android device, every iPhone, every Mac, every Windows 10/11 installation, and every major web browser, so the number of potentially affected endpoints is measured in the billions.

Technical Information

CVE-2026-11822 covers two separate memory corruption conditions in SQLite's FTS5 extension, both in ext/fts5/fts5_index.c. FTS5 is a virtual table module that adds full-text search to SQLite applications. It is widely used for native search in Android applications, in desktop applications, and in server-side deployments.

Root Cause: Out-of-Bounds Read in fts5LeafSeek()

The first bug is in the fts5LeafSeek() function. When FTS5 reads a leaf page from a database, a loop walks the page entries using a bound taken from the page data itself, so in a crafted database the attacker controls that bound. A malformed FTS5 leaf page can set the bound higher than the size of the allocated buffer, and the function then reads memory past the end of the buffer. This out-of-bounds read can leak sensitive heap contents or cause a segmentation fault that crashes the process.

Root Cause: Heap Buffer Overflow Write in fts5ChunkIterate()

The second bug is in the fts5ChunkIterate() function. When FTS5 processes continuation pages during index traversal, it computes a write offset or size from values read out of the page data. A crafted continuation page can cause an integer underflow in that computation, and the resulting write runs past the end of a heap-allocated buffer. This is CWE-122 (Heap-based Buffer Overflow), a well-understood weakness in which overwritten heap memory can corrupt function pointers, vtable entries, or heap metadata structures and redirect execution to attacker-controlled code.

Attack Flow

Exploitation has four stages:

1. The attacker builds a SQLite database file with malformed page data in its FTS5 index structures. The malformed data includes a manipulated loop bound for the fts5LeafSeek() bug and a crafted continuation page for the fts5ChunkIterate() bug.

2. The attacker delivers the file to the target application. Any path by which an application accepts or processes external SQLite databases could work, including file sharing, cloud sync, email attachments, imported backups, and content ingestion pipelines.

3. The target application opens the database and runs an FTS5 MATCH query against an FTS5 virtual table. This is the standard way to do full-text search in SQLite, and applications commonly run it when a user starts a search.

4. During index traversal, the corrupted page data triggers the memory corruption. The out-of-bounds read in fts5LeafSeek() fires during leaf page processing, and the heap buffer overflow write in fts5ChunkIterate() fires during continuation page processing.

Compound Exploitation Potential

The two bugs are more dangerous together than apart. An attacker can use the out-of-bounds read to leak heap data and map the heap layout of the target process. That map can then help turn the heap buffer overflow write into a reliable code execution primitive that bypasses heap randomization and other mitigations. Neither bug alone would allow that level of practical exploitability.

Fix Details

Two commits fix the vulnerability, and both modify ext/fts5/fts5_index.c:

Both commits carry the description "Fix potential buffer overwrite that could occur in fts5 when processing corrupt records." Each fix also added a regression test file, fts5corruptA.test, to verify the correction. The trunk commit landed first, and the branch-3.53 backport followed about 48 minutes later.

Affected Systems and Versions

All SQLite versions before 3.53.2 are affected. The vulnerable code is in the FTS5 full-text search extension, in ext/fts5/fts5_index.c.

The fixed version is SQLite 3.53.2, released on 2026-06-03. You can verify it with these values:

• SQLITE_SOURCE_ID: 2026-06-03 19:12:13 d6e03d8c777cfa2d35e3b60d8ec3e0187f3e9f99d8e2ee9cac695fd6fcdf1a24
• SHA3-256 of sqlite3.c amalgamation: 44fd61b9f93b4155105cb2d80c957ae6c64a8b5bd6ed51a4992f0dbd438e4e11

An application is vulnerable if all of the following are true:

• It embeds a SQLite version older than 3.53.2
• It includes the FTS5 extension (compiled in or loaded as an extension)
• It opens database files from sources an attacker could influence
• It runs FTS5 MATCH queries against those databases

Given how widely SQLite is deployed, the affected categories include:

• Mobile applications on Android and iOS
• Desktop applications, including browsers (Firefox, Chrome, Safari), messaging clients, and productivity tools
• Server-side applications that use SQLite for caching or search indexing
• IoT or embedded systems with SQLite-based storage

Vendor Security History

Recent SQLite releases have a notable record of memory corruption CVEs, FTS5 among them:

CVE-2025-7709 and now CVE-2026-11822 are both FTS5 memory corruption bugs, which suggests that the extension's complex index data structures are a persistent attack surface. The SQLite team has disputed some CVE classifications in the past. It called the RCE classification for CVE-2021-20227 misinformation, and it has pointed out that several CVEs attributed to SQLite were really bugs in wrapper libraries. CVE-2023-32697 was a Java JDBC wrapper flaw, and CVE-2022-38627 was a PHP SQL injection.

Whatever its stance on CVEs, the team's fix speed is commendable. The CVE-2026-11822 bugs were fixed on 2026-05-11 and shipped in release 3.53.2 on 2026-06-03. The CVE itself was published on 2026-06-09. Between the fix and that publication date, the patch was publicly accessible, but the security relevance of the update may not have been widely communicated.

References

• NVD: CVE-2026-11822
• SQLite Release 3.53.2 Changelog
• SQLite Check-in 061febcf41 (branch-3.53 fix)
• SQLite Check-in 4a5ad516ea (trunk fix)
• VulnCheck Advisory: SQLite before 3.53.2 Memory Corruption in FTS5 Extension
• SQLite Vulnerabilities Page
• SQLite: Most Widely Deployed Database Engine
• SQLite FTS5 Extension Documentation
• CWE-122: Heap-based Buffer Overflow
• CISA Known Exploited Vulnerabilities Catalog