{"id":"CVE-2026-119373","kind":"vulnerability","aliases":["CVE-2026-119373"],"related":[],"title":"SQLite: FTS5 heap overflow lets a crafted table crash the process","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.","summary":"SQLite builds with FTS5 before 3.54.0 contain a heap buffer overflow in fts5MergeRowidLists() when merging prefix doclists on detail=none tables. An attacker who can insert rows with negative rowids and run a prefix MATCH query can corrupt heap memory and crash the process.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-database","fts5","node","package","python","sqlite"],"not_affected_if":["detail-none-not-used","fts5-not-compiled","no-untrusted-input"],"how_to_check":"- Run `sqlite3 --version` or check the bundled SQLite version in your application (`select sqlite_version();`) and see whether it is below `3.54.0`.\n- Search your schema for FTS5 tables created with `detail=none` (`grep -i \"fts5\" schema.sql` and look for `detail=none`).","fix":"- SQLite: upgrade to `3.54.0` or later.","status":"open","published_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","triaged_at":"2026-10-30T12:32:06+00:00","updated_at":"2026-10-30T12:32:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:32:06Z","model":"claude-haiku-5-5","output":{"fix":"- SQLite: upgrade to `3.54.0` or later.","reach":"unknown","title":"SQLite: FTS5 heap overflow lets a crafted table crash the process","impact":"medium","summary":"SQLite builds with FTS5 before 3.54.0 contain a heap buffer overflow in fts5MergeRowidLists() when merging prefix doclists on detail=none tables. An attacker who can insert rows with negative rowids and run a prefix MATCH query can corrupt heap memory and crash the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["sqlite","fts5","python","node","embedded-database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Process crashes from heap corruption; code execution not stated.","analyst_note":"Confirm whether heap corruption could lead to code execution and check the SQLite 3.54.0 release notes for the fix.","how_to_check":"- Run `sqlite3 --version` or check the bundled SQLite version in your application (`select sqlite_version();`) and see whether it is below `3.54.0`.\n- Search your schema for FTS5 tables created with `detail=none` (`grep -i \"fts5\" schema.sql` and look for `detail=none`).","plain_action":"","needs_analyst":true,"not_affected_if":["fts5-not-compiled","detail-none-not-used","no-untrusted-input"],"who_is_affected":"Applications that embed SQLite built with FTS5 and use detail=none FTS5 tables where untrusted data can supply rowids and prefix queries. Systems using a SQLite build without FTS5, or with no untrusted input reaching those tables, are less exposed. unknown whether the sources name specific downstream products.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4163,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119373':14A,17A '-2026':13A,16A '3.54.0':31B,72C 'alloc':116C 'attack':48B,94C 'buffer':35B,79C,87C 'build':27B 'built':73C 'contain':32B,76C 'corrupt':63B,117C 'craft':7A 'crash':9A,67B,121C 'cve':12A,15A 'databas':20B 'detail':44B,90C,99C 'doclist':42B,93C 'embed':19B 'embedded-databas':18B 'fts5':2A,21B,29B,75C,101C 'fts5mergerowidlists':38B,82C 'heap':3A,34B,64B,78C,118C 'insert':51B 'let':5A 'match':60B,110C 'memori':65B,119C 'merg':40B,89C 'negat':54B,104C 'node':22B 'none':45B,91C,100C 'output':86C 'overflow':4A,36B,80C 'packag':23B 'past':114C 'popul':97C 'prefix':41B,59B,92C,109C 'process':11A,69B,123C 'python':24B 'queri':61B,111C 'row':52B 'rowid':55B,105C 'run':57B,107C 'sqlite':1A,25B,26B,70C 'tabl':8A,46B,102C 'unders':84C 'write':113C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed SQLite built with FTS5 and use detail=none FTS5 tables where untrusted data can supply rowids and prefix queries. Systems using a SQLite build without FTS5, or with no untrusted input reaching those tables, are less exposed. unknown whether the sources name specific downstream products.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","severity":null,"published_at":"2026-10-30T12:16:36+00:00","modified_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","fetched_at":"2026-10-30T12:30:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}