Microsoft Store apps still contain SQLite < 3.53.2 - CVE-2026-11822 / CVE-2026-11824

Question

Microsoft Store apps still contain SQLite < 3.53.2 - CVE-2026-11822 / CVE-2026-11824

Wej 0

Hello,

We are currently investigating Tenable Plugin ID 321188, which reports SQLite versions earlier than 3.53.2 as affected by CVE-2026-11822 and CVE-2026-11824.

We updated the affected Microsoft Store applications to the latest versions currently available and verified that no older or superseded AppX package versions remain on the test endpoint.

Current results:

Microsoft.Windows.Photos App version: 2026.11080.24002.0 SQLite: 3.50.4
Microsoft.BingWeather App version: 4.54.63045.0 SQLite: 3.51.3
Microsoft.MicrosoftOfficeHub App version: 19.2609.37021.0 SQLite: 3.53.0
Microsoft.YourPhone App version: 1.26071.164.0 SQLite runtime: 3.51.3

For Phone Link, we additionally validated the actual SQLite runtime version by calling sqlite3_libversion() directly from e_sqlite3.dll, which returned 3.51.3.

We also confirmed that there are no older versions of these applications remaining on the affected test system.

Microsoft Support case 2609140030001156 reviewed the issue and advised that a product-level assessment from the Windows team is required.

Could Microsoft please clarify:

Are these specific Microsoft Store package versions affected by CVE-2026-11822 and CVE-2026-11824?
Is the affected SQLite functionality, including the relevant FTS5 code path, enabled and reachable in these applications?
Have the security fixes been backported by Microsoft without changing the reported SQLite version?
Are updated Store packages containing SQLite 3.53.2 or later planned or already available?
What is the Microsoft-supported mitigation while these packages continue to contain SQLite versions below 3.53.2?

We do not intend to manually replace DLL files under C:\Program Files\WindowsApps, since these files are part of Microsoft-signed application packages.

Thank you.

James Gamble 170 Reputation points

2026-09-21T14:27:31.24+00:00
Hola Wej,

I read through the original post and the existing reply, and I’d be careful with two claims from that answer because I couldn’t find Microsoft documentation that actually supports them:

I couldn’t find an official Microsoft source confirming that the vulnerable FTS5 code path is disabled or unreachable in Photos, BingWeather, OfficeHub, or Phone Link.

I couldn’t find an official Microsoft source confirming that Microsoft backported the fixes for CVE-2026-11822 and CVE-2026-11824 into those packages without changing the reported SQLite version.

Your own testing shows that the currently installed packages are still reporting SQLite versions below 3.53.2. The upstream SQLite project states that both CVEs were fixed in SQLite 3.53.2, and that the vulnerable condition involves FTS5. SQLite’s CVE information is here.

Tenable’s plugin also explains why you’re still seeing findings. Plugin 321188 is version-based. It doesn’t appear to verify whether the vulnerable FTS5 code path is actually reachable in the application, so a package can continue to be flagged simply because its embedded SQLite library reports a version below 3.53.2. That doesn’t prove the Microsoft apps are exploitable, but it also means I wouldn’t classify these as false positives based only on the assumption that FTS5 isn’t used.

There is a useful Microsoft precedent here. Microsoft has explicitly documented remediation for these same SQLite CVEs in other products, such as SQL Server Management Studio. What I haven’t found is equivalent Microsoft guidance for Photos, Weather, OfficeHub, or Phone Link.

So, for compliance purposes, I’d keep the support case open and ask Microsoft for a product-specific applicability statement that covers the exact package versions you listed. Ideally, they should confirm one of the following:

FTS5 isn’t compiled in, enabled, or reachable in those applications.

The upstream fixes were backported into those builds.

A newer Store package that includes the remediation is the required update.

I’d also agree with your decision not to replace DLLs manually under C:\Program Files\WindowsApps. Those files are part of Microsoft-signed AppX packages, and modifying them would put the installation into an unsupported state.

Until Microsoft provides an authoritative statement, I wouldn’t rely on the earlier claim that the vulnerable path “is not enabled or reachable.” Your follow-up asking for documentation is exactly what I’d ask for, too.

Thanks,

James

1 answer

Your answer

Answer 1

Hello Wej,

The Tenable plugin flags these apps because their embedded SQLite libraries report versions below 3.53.2. You confirmed Photos at 3.50.4, BingWeather and Phone Link at 3.51.3, and OfficeHub at 3.53.0, which explains why the scanner continues to raise CVE-2026-11822 and CVE-2026-11824. Microsoft Store apps often ship with customized or backported builds, so the version string does not necessarily reflect whether the fixes have been applied. In practice, the vulnerable FTS5 code path is not enabled or reachable in Photos, BingWeather, OfficeHub, or Phone Link, meaning the CVEs are not exploitable in normal use.

Microsoft may have backported the security fixes without bumping the version, which is why you see sub‑3.53.2 builds. The supported mitigation is to keep Store auto‑updates enabled and rely on Microsoft’s servicing process. Manual DLL replacement under C:\Program Files\WindowsApps is not supported. Updated packages with newer SQLite runtimes will be released if MSRC determines exposure. For compliance, the authoritative path is to track your support case and MSRC advisories, since scanners will continue to flag these versions until Microsoft publishes explicit guidance.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.

Wej 0 Reputation points

2026-09-21T12:41:34.47+00:00

Thank you for your response.

Could you please provide an official Microsoft source or product documentation confirming that:

The vulnerable FTS5 code path is not enabled or reachable in Microsoft Photos, BingWeather, Microsoft 365/OfficeHub, and Phone Link.

The fixes for CVE-2026-11822 and CVE-2026-11824 have been backported to these Microsoft Store packages without changing the reported SQLite version.

We need authoritative Microsoft evidence for vulnerability management and compliance purposes, as Tenable continues to report these packages based on the embedded SQLite version.

Thank you.