{"id":"CVE-2026-119374","kind":"vulnerability","aliases":["CVE-2026-119374"],"related":[],"title":"SQLite: crafted FTS5 index overflows heap during secure delete","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.","summary":"SQLite builds with FTS5 enabled that are older than 3.54.0 have a heap buffer overflow in fts5DoSecureDelete(). An attacker who supplies a database file with a corrupted FTS5 index can corrupt heap memory and crash the application when a row is deleted with secure-delete on.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-databases","fts5","package","sqlite"],"not_affected_if":["fts5-not-enabled","secure-delete-off","trusted-database-files-only"],"how_to_check":"- Check the SQLite version your application links against, for example `sqlite3 --version`, or the bundled version in your language binding.\n- Check whether FTS5 is compiled in and whether `PRAGMA secure_delete` is enabled in your application.\n- Check whether your application opens database files that come from untrusted sources.","fix":"- SQLite versions before `3.54.0` are affected; move to `3.54.0` or later.","status":"open","published_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","triaged_at":"2026-10-30T12:32:05+00:00","updated_at":"2026-10-30T12:32:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:32:05Z","model":"claude-haiku-5-5","output":{"fix":"- SQLite versions before `3.54.0` are affected; move to `3.54.0` or later.","reach":"local","title":"SQLite: crafted FTS5 index overflows heap during secure delete","impact":"medium","summary":"SQLite builds with FTS5 enabled that are older than 3.54.0 have a heap buffer overflow in fts5DoSecureDelete(). An attacker who supplies a database file with a corrupted FTS5 index can corrupt heap memory and crash the application when a row is deleted with secure-delete on.","audience":"developers","category":"package","nicknames":[],"who_cares":["sqlite","fts5","embedded-databases"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Heap memory corruption crashes the application; code execution not stated.","analyst_note":"Confirm whether the overflow can go beyond a crash to code execution and whether a fixed release beyond 3.54.0 is listed in the SQLite release notes.","how_to_check":"- Check the SQLite version your application links against, for example `sqlite3 --version`, or the bundled version in your language binding.\n- Check whether FTS5 is compiled in and whether `PRAGMA secure_delete` is enabled in your application.\n- Check whether your application opens database files that come from untrusted sources.","plain_action":"","needs_analyst":true,"not_affected_if":["fts5-not-enabled","secure-delete-off","trusted-database-files-only"],"who_is_affected":"Applications that embed SQLite built with FTS5 and open database files that an outside party could have supplied or tampered with, and that run deletes with secure-delete enabled. Applications that only open databases they create themselves, or that do not use FTS5 or secure-delete, are less exposed. The sources do not say whether exploitation goes beyond a crash.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4162,"output_tokens":666,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119374':12A,15A '-2026':11A,14A '3.54.0':31B,70C 'allow':82C 'applic':58B,122C 'attack':40B,83C,96C 'buffer':35B,77C,90C 'build':23B 'built':71C 'contain':74C 'corrupt':48B,52B,104C,116C 'craft':2A,92C 'crash':56B,120C 'cve':10A,13A 'databas':18B,44B,100C 'delet':9A,63B,67B,109C,114C 'embed':17B 'embedded-databas':16B 'enabl':26B,115C 'file':45B,101C 'footer':93C 'fts5':3A,19B,25B,49B,73C,105C 'fts5dosecuredelete':38B,80C 'heap':6A,34B,53B,76C,117C 'index':4A,50B,106C 'key':94C 'leaf':88C 'memori':54B,118C 'offset':95C 'older':29B 'overflow':5A,36B,78C 'packag':20B 'page':89C 'past':86C 'row':61B 'secur':8A,66B,113C 'secure-delet':65B,112C 'sqlite':1A,21B,22B,68C 'suppli':42B,98C 'via':91C 'write':85C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed SQLite built with FTS5 and open database files that an outside party could have supplied or tampered with, and that run deletes with secure-delete enabled. Applications that only open databases they create themselves, or that do not use FTS5 or secure-delete, are less exposed. The sources do not say whether exploitation goes beyond a crash.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","severity":null,"published_at":"2026-10-30T12:16:36+00:00","modified_at":"2026-10-30T12:16:36+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","fetched_at":"2026-10-30T12:30:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}