CVE-2026-119373
Received Received - Intake

SQLite FTS5 Heap Buffer Overflow via Negative Rowids

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119373
EUVD
EUVD-2026-113784

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SQLite SQLite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119373 is a heap buffer overflow in SQLite's FTS5 extension affecting versions before 3.54.0. The flaw occurs in the fts5MergeRowidLists() function when merging detail=none prefix doclists. It undersizes the output buffer by incorrectly calculating sizes for delta-encoded rowids, leading to potential heap memory corruption and crashes when processing crafted prefix queries with negative rowids.

Detection Guidance

To detect this vulnerability, check your SQLite version with 'sqlite3 --version'. If it is below 3.54.0, the system is vulnerable. Additionally, review applications using FTS5 with detail=none and negative rowids. No specific commands are provided in the resources to actively detect exploitation.

Impact Analysis

This vulnerability can cause heap memory corruption and process crashes when an attacker populates a detail=none FTS5 table with negative rowids and executes a prefix MATCH query. While it does not demonstrate remote code execution in tested scenarios, it may lead to denial-of-service conditions or data corruption in applications using vulnerable SQLite versions.

Mitigation Strategies

Upgrade SQLite to version 3.54.0 or later immediately. If upgrading is not possible, disable FTS5 detail=none tables or avoid using negative rowids in FTS5 tables. Monitor for crashes or memory corruption in applications using SQLite.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart