Live › vulnerability › CVE-2026-119373
SQLite builds with FTS5 before 3.54.0 contain a heap buffer overflow in fts5MergeRowidLists() when merging prefix doclists on detail=none tables. An attacker who can insert rows with negative rowids and run a prefix MATCH query can corrupt heap memory and crash the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that embed SQLite built with FTS5 and use detail=none FTS5 tables where untrusted data can supply rowids and prefix queries. Systems using a SQLite build without FTS5, or with no untrusted input reaching those tables, are less exposed. unknown whether the sources name specific downstream products.
No product ranges from the sources yet.
sqlite3 --version or check the bundled SQLite version in your application (select sqlite_version();) and see whether it is below 3.54.0.detail=none (grep -i "fts5" schema.sql and look for detail=none).3.54.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-119373")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.