noindex and left out of the sitemap until more data is confirmed.CVE-2026-11822 is a heap buffer overflow in SQLite's FTS5 full-text search extension, triggered by running a MATCH query against a maliciously crafted database, that reaches Siemens RUGGEDCOM CROSSBOW Station Access Controller because that product bundles the vulnerable SQLite build; NVD has not yet published its own CVSS score, so this page stays noindex until that analysis lands.
Vulnerability summary
N/A
Not yet scored
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2026-06-09
Published
Vulnerability ID: CVE-2026-11822 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) | cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* | All versions before V6.0 (ships bundled SQLite before 3.53.2 with the vulnerable FTS5 extension; fixed in SAC V6.0) |
What this means
CVE-2026-11822 (CWE-122, heap-based buffer overflow) affects the FTS5 full-text search extension in SQLite before 3.53.2. NVD's description states the extension "contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data," with attackers able to "trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database" (NVD).
NVD tracks the CVE with status "Modified" (previously analyzed, then revised) as of 2026-10-26. The severity data on record — CVSS v3.1 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and CVSS v4.0 8.5 (high) — is attributed to VulnCheck as the scoring CNA, not to NVD's own analysts, so this page leaves cvss_score unset rather than presenting that figure as NVD-confirmed (NVD).
This SQLite flaw reaches an industrial product because Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) ships a bundled copy of the affected SQLite build. CISA's ICS advisory ICSA-26-295-15, republishing Siemens' advisory on 2026-10-22, lists CVE-2026-11822 together with four other third-party SQLite CVEs (CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11824) affecting SAC versions before V6.0, states "Siemens ProductCERT reported these vulnerabilities to CISA" after reviewing bundled components, and gives a single remediation for all five: update to SAC V6.0 or later (CISA ICS Advisory ICSA-26-295-15).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00364 (29.972th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, RUGGEDCOM CROSSBOW SAC operators should update to V6.0 or later and avoid running FTS5 MATCH queries against untrusted SQLite databases through the bundled extension.
Evidence
- SQLite before 3.53.2 has a heap buffer overflow in the FTS5 extension's fts5ChunkIterate()/fts5LeafSeek() path, exploitable via a crafted database and an FTS5 MATCH query (CWE-122). — NVD
- NVD status is "Modified" with a VulnCheck-scored CVSS v3.1 7.8 (high) and CVSS v4.0 8.5 (high); no NVD-published independent score as of 2026-10-26. — NVD
- Bundled in Siemens RUGGEDCOM CROSSBOW SAC before V6.0 alongside four other SQLite CVEs; Siemens ProductCERT reported the issues; fix is SAC V6.0 or later. — CISA ICS Advisory ICSA-26-295-15
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00364 (29.972th percentile) as of 2026-10-26. — FIRST EPSS
