{"id":"AZL-89703","summary":"CVE-2026-11824 affecting package sqlite for versions less than 3.44.0-4","details":"SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.","modified":"2026-08-29T05:27:27Z","published":"2026-06-09T20:16:32Z","upstream":["CVE-2026-11824"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11824"}],"affected":[{"package":{"name":"sqlite","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/sqlite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.0-4"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-89703.json"}}],"schema_version":"1.9.0"}