CVE-2026-119374: SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()

Published Oct 30, 2026

Updated

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.

Other sources

SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()

— Microsoft

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SQLite to a version that resolves this vulnerability.
Fixed in 3.54.0

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Oct 31, 2026

Data Sourced

via Microsoft·08:04 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using SQLite versions before 3.54.0 are exposed when SQLite is built with FTS5 and secure-delete is enabled. The vulnerable path is relevant when the application deletes data from a database containing a corrupted FTS5 index.

What does an attacker need to do to trigger the issue?

An attacker needs to supply a database file with a crafted, corrupted FTS5 index containing malicious footer key offsets. The application must then perform a deletion operation while secure-delete is enabled.

What is the practical impact of successful exploitation?

The crafted offsets can cause writes past the leaf page buffer, corrupting heap memory. The reported outcome includes application crashes.

How can I determine whether an application is affected?

Check whether the application uses SQLite before 3.54.0, whether its SQLite build includes FTS5, and whether secure-delete is enabled. Exposure is most relevant if the application accepts database files from untrusted sources and deletes data from them.

What version should be used to remediate this issue?

Upgrade SQLite to version 3.54.0 or later. The issue affects versions before 3.54.0.

CVE-2026-119374: SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()

Other sources

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to trigger the issue?

What is the practical impact of successful exploitation?

How can I determine whether an application is affected?

What version should be used to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to trigger the issue?

What is the practical impact of successful exploitation?

How can I determine whether an application is affected?

What version should be used to remediate this issue?