Show Bug.cgi

bugzilla.suse.com • June 17, 2026

Share: View original

VUL-0: CVE-2026-11824: sqlite2,sqlite3: heap-based buffer overflow vulnerability in the FTS5 full-text extension that allows attackers to cause a crash or execute arbitrary code

Last modified: 2026-06-17 12:35:56 UTC

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in sqlite3 Affecting SUSE Systems SUSE has released an important update addressing two critical vulnerabilities in sqlite3, specifically within the FTS5 full-text extension. CVE-2026-11822 involves memory corruption that could lead to process crashes, memory exhaustion, or arbitrary code execution. CVE-2026-11824 is a heap-based buffer overflow vulnerability that allows similar exploitative outcomes. Both vulnerabilities have a CVSS score of 7.8 from SUSE and 8.5 from NVD, indicating a high severity level. The vulnerabilities were published on June 9, 2026, and the update was released on June 15, 2026. Affected systems include sqlite2 and sqlite3, which are widely used in various applications. Users are advised to apply the patches immediately to mitigate potential risks. 6 sources 72

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CWE Weaknesses (1)

Cwe-122 - Heap-based Buffer Overflow

Platforms (3)

FTS5 Full-text Extension Sqlite2 Sqlite3