Live › vulnerability › CVE-2026-119374
SQLite builds with FTS5 enabled that are older than 3.54.0 have a heap buffer overflow in fts5DoSecureDelete(). An attacker who supplies a database file with a corrupted FTS5 index can corrupt heap memory and crash the application when a row is deleted with secure-delete on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that embed SQLite built with FTS5 and open database files that an outside party could have supplied or tampered with, and that run deletes with secure-delete enabled. Applications that only open databases they create themselves, or that do not use FTS5 or secure-delete, are less exposed. The sources do not say whether exploitation goes beyond a crash.
No product ranges from the sources yet.
sqlite3 --version, or the bundled version in your language binding.PRAGMA secure_delete is enabled in your application.3.54.0 are affected; move to 3.54.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-119374")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.