Show Bug.cgi

bugzilla.suse.com • June 17, 2026

VUL-0: CVE-2026-11822: sqlite2,sqlite3: memory corruption vulnerabilities in the FTS5 full-text extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution

Last modified: 2026-06-17 12:35:55 UTC

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in sqlite3 Affecting SUSE Systems SUSE has released an important update addressing two critical vulnerabilities in sqlite3, specifically within the FTS5 full-text extension. CVE-2026-11822 involves memory corruption that could lead to process crashes, memory exhaustion, or arbitrary code execution. CVE-2026-11824 is a heap-based buffer overflow vulnerability that allows similar exploitative outcomes. Both vulnerabilities have a CVSS score of 7.8 from SUSE and 8.5 from NVD, indicating a high severity level. The vulnerabilities were published on June 9, 2026, and the update was released on June 15, 2026. Affected systems include sqlite2 and sqlite3, which are widely used in various applications. Users are advised to apply the patches immediately to mitigate potential risks. 6 sources 72

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CVE-2026-11822