High severity · published Oct 30, 2026
CVE-2026-119373
SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
New
7.8
CVSS
–
EPSS
No
On KEV
Description
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
SQLite · SQLite
before 3.54.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119373
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119373
issue-tracking
https://sqlite.org/bugs/info/2026-08-04T08:49:27Z
patch
https://sqlite.org/src/info/a7f8c92f62
patch
https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80
technical-description
https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107
release-notes
https://sqlite.org/releaselog/3_54_0.html
third-party-advisory
https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge
More from SQLite
9.8
CVE-2025-3277
An integer overflow can be triggered in SQLite’s `concat_ws()` function
9.8
CVE-2020-35527
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause
9.8
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement
9.8
CVE-2019-19646
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns
9.8
CVE-2019-19317
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly…