SQLite FTS5 memory corruption vulnerabilities CVE-2026-11822, CVE-2026-11824 #10550

Describe the bug

The current version of AWS CLI install on Windows systems has a version of SQLite embedded via the python version that has these security findings.
Current state:
AWS CLI version: 2.36.12
Bundled Python: 3.14.6
Bundled SQLite: 3.50.4

Required for CVE remediation:
SQLite: 3.53.2 or later

CVEs affected:
CVE-2026-11822 - Memory corruption in FTS5 (fts5LeafSeek out-of-bounds read + fts5ChunkIterate heap buffer overflow)
CVE-2026-11824 - Heap-based buffer overflow in FTS5 (fts5ChunkIterate integer underflow)

Fix released by SQLite:
SQLite 3.53.2 - Released June 3, 2026 [1]

AWS support advised that we open an issue here to request an update to the package.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

After testing an updated / python / SQLite version be used in the AWS CLI.

Current Behavior

Current state:
AWS CLI version: 2.36.12
Bundled Python: 3.14.6
Bundled SQLite: 3.50.4

Reproduction Steps

Download and install the latest CLI version. from "https://awscli.amazonaws.com/AWSCLIV2.msi"

Possible Solution

a patched version be published to "https://awscli.amazonaws.com/AWSCLIV2.msi"

Additional Information/Context

No response

CLI version used

2.36.12

Environment details (OS name and version, etc.)

Windows version 11, server version 2025/2022/2019