---
id: "CVE-2026-119374"
kind: "vulnerability"
aliases: ["CVE-2026-119374"]
title: "SQLite: crafted FTS5 index overflows heap during secure delete"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded-databases", "fts5", "package", "sqlite"]
not_affected_if: ["fts5-not-enabled", "secure-delete-off", "trusted-database-files-only"]
published_at: "2026-10-30T12:16:36+00:00"
first_seen_at: "2026-10-30T12:30:23+00:00"
updated_at: "2026-10-30T12:32:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119374", "first_seen_at": "2026-10-30T12:30:23+00:00"}]
---

# SQLite: crafted FTS5 index overflows heap during secure delete

SQLite builds with FTS5 enabled that are older than 3.54.0 have a heap buffer overflow in fts5DoSecureDelete(). An attacker who supplies a database file with a corrupted FTS5 index can corrupt heap memory and crash the application when a row is deleted with secure-delete on.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SQLite version your application links against, for example `sqlite3 --version`, or the bundled version in your language binding.
- Check whether FTS5 is compiled in and whether `PRAGMA secure_delete` is enabled in your application.
- Check whether your application opens database files that come from untrusted sources.

## Fix

- SQLite versions before `3.54.0` are affected; move to `3.54.0` or later.

## Timeline

- 2026-10-30T12:30:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119374

## From the sources

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_