SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
CVSS Details
- CVSS 4.0 Base Score: 8.5 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade sqlite-libsUpgrade sqliteUpgrade sqlite-develUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade sqlite-docUpgrade lemonUpgrade npmUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-nodemon | Oct 11, 2026 | Aug 12, 2026 |
| Alpine Linux | — | Upgrade sqlite | Aug 19, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade sqliteUpgrade sqlite-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade sqlite-debugsourceUpgrade sqlite-debuginfoUpgrade sqlite-develUpgrade nodejs22-full-i18nUpgrade nodejs24-npmUpgrade v8-13.6-develUpgrade nodejs22-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-docsUpgrade sqlite-libsUpgrade sqlite-analyzerUpgrade sqlite-tcl-debuginfoUpgrade sqlite-tools-debuginfoUpgrade nodejs22-libsUpgrade lemon-debuginfoUpgrade lemonUpgrade sqlite-tclUpgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-develUpgrade v8-12.4-develUpgrade sqlite-docUpgrade nodejs24Upgrade nodejs24-debuginfoUpgrade sqlite-analyzer-debuginfoUpgrade sqlite-toolsUpgrade nodejs22-debugsourceUpgrade nodejs22-npmUpgrade nodejs22-docsUpgrade nodejs22Upgrade nodejs24-devel | Jul 8, 2026 | Jun 9, 2026 |
| Debian | — | Upgrade sqlite3 | Sep 21, 2026 | Jun 9, 2026 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade lemonUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade sqlite-docUpgrade sqlite-develUpgrade nodejs-packaging-bundlerUpgrade sqlite-libsUpgrade nodejs-docsUpgrade sqliteUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs | Oct 22, 2026 | Jun 9, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Sep 16, 2026 | Jun 9, 2026 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade sqlite-docUpgrade nodejs-packaging-bundlerUpgrade lemonUpgrade nodejs-develUpgrade sqlite-libsUpgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade sqlite-libs-debuginfoUpgrade sqlite-analyzer-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoNo solution existsUpgrade sqlite-develUpgrade nodejs-debuginfoUpgrade sqlite-debugsourceUpgrade sqlite-tools-debuginfoUpgrade sqlite-tcl-debuginfoUpgrade sqliteUpgrade npmUpgrade sqlite-debuginfoUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade lemon-debuginfo | Aug 26, 2026 | Jun 9, 2026 |
| Rocky_linux | — | Upgrade npmUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs-develUpgrade sqlite-debuginfoUpgrade sqlite-develUpgrade sqlite-libsUpgrade nodejs-debuginfoUpgrade sqlite-libs-debuginfoUpgrade nodejsUpgrade lemon-debuginfoUpgrade sqliteUpgrade lemonUpgrade sqlite-debugsourceUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsource | Aug 27, 2026 | Aug 25, 2026 |
| Ubuntu | — | Upgrade libsqlite3-0 | Jun 30, 2026 | Jun 29, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 22, 2026 | Jun 9, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub