Heap Buffer Overflow in SQLite FTS5 by SQLite

CVE-2026-119374

What is CVE-2026-119374?

A heap buffer overflow vulnerability exists in the SQLite FTS5 extension prior to version 3.54.0 in the fts5DoSecureDelete() function. This flaw permits attackers to write beyond the allocated heap memory by exploiting crafted footer key offsets along with a corrupted FTS5 index within a database file. When secure deletion features are triggered, it can lead to significant memory corruption issues, resulting in application crashes and potential unauthorized access. It is crucial for users to update to the latest version to mitigate these vulnerabilities.

References