SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.
CVSS Details
- CVSS 4.0 Base Score: 8.5 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade v8-12.4-develUpgrade mingw32-sqliteUpgrade mingw64-sqlite-staticUpgrade nodejs-docsUpgrade nodejs-develUpgrade sqlite-develUpgrade sqlite-libsUpgrade v8-13.6-develUpgrade npmUpgrade lemonUpgrade sqliteUpgrade nodejs-packagingUpgrade sqlite-docUpgrade nodejsUpgrade nodejs-libsUpgrade mingw64-sqliteUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade mingw32-sqlite-static | Oct 11, 2026 | Aug 12, 2026 |
| Alpine Linux | — | Upgrade sqlite | Aug 19, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-libs-debuginfoUpgrade v8-12.4-develUpgrade lemon-debuginfoUpgrade sqlite-tclUpgrade nodejs22-npmUpgrade nodejs24-libsUpgrade sqlite-toolsUpgrade nodejs24-debuginfoUpgrade sqlite-docUpgrade nodejs22-develUpgrade nodejs22-debugsourceUpgrade nodejs22-libsUpgrade nodejs24Upgrade sqlite-develUpgrade nodejs24-full-i18nUpgrade lemonUpgrade nodejs24-develUpgrade sqlite-analyzer-debuginfoUpgrade sqlite-debuginfoUpgrade sqlite-debugsourceUpgrade v8-13.6-develUpgrade nodejs24-npmUpgrade nodejs24-debugsourceUpgrade sqliteUpgrade sqlite-tcl-debuginfoUpgrade nodejs22-full-i18nUpgrade sqlite-analyzerUpgrade nodejs22-libs-debuginfoUpgrade nodejs22Upgrade sqlite-tools-debuginfoUpgrade nodejs24-docsUpgrade sqlite-libsUpgrade sqlite-libs-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs22-docs | Jul 8, 2026 | Jun 9, 2026 |
| Debian | — | Upgrade sqlite3 | Sep 21, 2026 | Jun 9, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Sep 18, 2026 | Jun 9, 2026 |
| Redhat_linux | — | Upgrade sqlite-debuginfoUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-full-i18nUpgrade sqliteUpgrade mingw64-sqliteNo solution existsUpgrade nodejs-docsUpgrade sqlite-tools-debuginfoUpgrade mingw64-sqlite-debuginfoUpgrade npmUpgrade mingw32-sqlite-debuginfoUpgrade sqlite-debugsourceUpgrade sqlite-tcl-debuginfoUpgrade sqlite-libs-debuginfoUpgrade nodejs-libsUpgrade v8-12.4-develUpgrade sqlite-analyzer-debuginfoUpgrade mingw32-sqlite-staticUpgrade nodejs-libs-debuginfoUpgrade lemon-debuginfoUpgrade nodejs-debugsourceUpgrade sqlite-docUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade sqlite-libsUpgrade mingw64-sqlite-staticUpgrade mingw32-sqliteUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-develUpgrade sqlite-develUpgrade lemon | Aug 26, 2026 | Jun 9, 2026 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade sqlite-libsUpgrade nodejs-debuginfoUpgrade nodejsUpgrade sqlite-develUpgrade v8-13.6-develUpgrade sqlite-libs-debuginfoUpgrade lemonUpgrade nodejs-full-i18nUpgrade sqliteUpgrade sqlite-debugsourceUpgrade npmUpgrade v8-12.4-develUpgrade sqlite-debuginfoUpgrade lemon-debuginfoUpgrade nodejs-libs | Aug 27, 2026 | Aug 25, 2026 |
| Ubuntu | — | Upgrade libsqlite3-0 | Jun 30, 2026 | Jun 29, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 22, 2026 | Jun 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub