UBUNTU-CVE-2026-119373: Buffer Overflow
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.54.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using SQLite versions before 3.54.0 that were built with FTS5 are affected when they use detail=none FTS5 tables with prefix searching. The listed Ubuntu packages are sqlite3 and sqlite.
What must an attacker be able to do?
An attacker needs to populate a detail=none FTS5 table with negative rowids and cause a prefix MATCH query to run against the affected data. The vulnerability is locally exploitable and requires user interaction according to the supplied vector.
What is the potential impact?
The flawed merge operation can write beyond a heap allocation, corrupting process memory and crashing the process. The supplied severity vector rates confidentiality, integrity, and availability impacts as high.