CVE-2026-119373: SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
Published Oct 30, 2026
·Updated
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
Other sources
SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
— Microsoft
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.54.0
Event History
Oct 30, 2026
CVE Published
via MITRE·11:30 AM
Data Sourced
via MITRE·11:30 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeakness
Oct 31, 2026
Data Sourced
via Microsoft·08:04 AM
DescriptionSeverityWeakness