CVE-2026-11822

MediumCVSS 5.5/10Last modified Oct 30, 2026

Description

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
SQLiteSQLite< 3.53.2
SiemensRUGGEDCOM CROSSBOW Station Access Controller (SAC)< V6.0

References

Timeline

Published
Jun 9, 2026
Last modified
Oct 30, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1182207.8Double free in Windows Multiple Provider Router allows an authorized attacker to elevate privileges locally.CVE-2026-1182218.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182227.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182237.8Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182247.8Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182258.8Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevateCVE-2026-1182268.8Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182278.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182288.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182298.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-118237.5The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bCVE-2026-1182328.8Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-11822: Medium severity, CVSS 5.5 | Vulnix