HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-11824 — SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the ...

·Source: NIST NVD

Updated:

Executive Summary

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count d

Analysis

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5. CVSS Score: 7.8. Published: 2026-06-09T20:16:32.300.

Indicators of Compromise (1)

CVE (1)
CVE-2026-11824
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 9, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

Siemens RUGGEDCOM CROSSBOW Station Access Controller

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-15.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information

CVE-2025-6965CVE-2025-70873
CISA Advisories
MEDIUMVulnerability

CISO Problems That Can't Be Solved With Technology

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ciso-problems-that-cant-be-solved-technology-image_small-4-a-33248.jpg" align=right hspace=4><b>Operational Struggles and Arrogant Vendors Mean Tool Churn Is Likely to Continue</b><br>No matter how advanced or powerful cybersecurity tools become, they will never be able to fix many of the key problems that confront cyber defenders

Bank Info Security
LOWAi

Fake Anthropic AI previews lure in overeager employees

Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private invite-only Anthropic preview. In reality, adversarial actors are trying to steal Google and Microsoft login credentials, exploi

CSO Online