Heap Buffer Overflow in SQLite FTS5 Affects Multiple Applications
CVE-2026-119373

8.5HIGH

Key Information:

Vendor

Sqlite

Status
Sqlite
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119373?

A heap buffer overflow has been identified in SQLite's FTS5 module prior to version 3.54.0. The vulnerability exists in the fts5MergeRowidLists() function, which improperly handles output buffers when merging detail=none prefix doclists. This flaw allows attackers to populate a FTS5 table with negative rowids and execute a prefix MATCH query, resulting in potential memory corruption and process crashes. Users are encouraged to upgrade to the latest version to mitigate this risk.

Affected Version(s)

SQLite All platforms where SQLITE_ENABLE_FTS5 is defined 0 < 3.54.0

References

https://sqlite.org/bugs/info/2026-08-04T08:49:27Z
issue-tracking
https://sqlite.org/src/info/a7f8c92f62
patch
https://github.com/sqlite/sqlite/commit/e1c9934f9f11a4990...
patch

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michele
Abraxas Labs
Dan Kennedy
.