Is the DLP vulnerable to CVE-2026-11822, or CVE-2026-11824

Products

• Data Loss Prevention

Issue/Introduction

CVE-2026-11822:

SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.

 

CVE-2026-11824:

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.

Resolution

DLP endpoint agent does not load any sqlite3 module, and hence it is not impacted by CVE-2026-11824 or CVE-2026-11822.

SQLite EAD DB files are used to store data on DLP Endpoint Agent only. From the DLP server perspective, none of DLP servers use and store data using SQLite, hence these vulnerabilities do not apply here.

FTS5 is not compiled into the agent's SQLite build. The agent uses SQLite exclusively for internal encrypted data stores (configuration, keystore, incident data, RRC) with standard SQL operations. 

Also note, module loading is turned-off by default in sqlite3.