SQLite before 3.53.2 contains an out‑of‑bounds read vulnerability in the FTS5 full‑text search extension. An attacker can supply a crafted database with a malformed FTS5 leaf page, causing fts5LeafSeek() to read past the end of the page buffer while comparing terms during an FTS5 MATCH query. The result is a process crash, which could be interpreted as a denial‑of‑service attack. The flaw is categorized as CWE‑125 (Out‑of‑Bounds Read).

All installations of SQLite older than 3.53.2 are affected, regardless of platform or usage context. This includes embedded databases in desktop applications, mobile apps, web servers, and any system component that loads SQLite databases without validating their integrity. The key product is SQLite itself, with the affected range being all releases prior to 3.53.2.

The CVSS score of 6.8 marks this flaw as medium severity. The EPSS score of <1% indicates a very low probability of exploitation, yet the presence of an out‑of‑bounds read and the resulting process crash indicates a significant exploitability risk when an attacker can introduce or control the database file. The vulnerability is not listed in the CISA KEV catalog, yet the denial‑of‑service potential warrants immediate attention. Attackers can exploit the flaw by delivering a malicious database to an application that uses the FTS5 extension, triggering a MATCH query. The impact could range from denial of service to potential compromise depending on the privileges of the affected process.