SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
Affects SQLite versions before 3.54.0 built with the FTS5 extension, where an FTS5 table is created with detail=none and a crafted prefix query is run. Fixed in 3.54.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 3.54.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SQLite versions before 3.54.0 are affected when compiled with the FTS5 full-text search extension. An attacker who can insert data into a specific FTS5 table configuration and run a prefix search query could corrupt memory, potentially crashing the application that uses SQLite.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- SQLite SQLite
fixed in 3.54.0
References 8
GitHub · sqlite/sqlite
abraxaslabs.tech
Questions about CVE-2026-119373
What does this mean?
A crafted prefix query run against an FTS5 table can make SQLite write past the end of a heap buffer in sqlite3Fts5PutVarint(). This is a heap out-of-bounds write.Source: sqlite.org
Am I affected, and how do I check?
SQLite versions before 3.54.0 that are built with FTS5 enabled, and where an FTS5 table was created with detail=none. To check, run select sqlite_version(); to see the version, and check the build options or table definitions for FTS5 and detail=none.Source: sqlite.org
What should I do about it?
Upgrade SQLite to version 3.54.0 or later, which contains the fix.Source: sqlite.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data