CVE-2026-119374
Received Received - Intake

SQLite FTS5 Heap Buffer Overflow Vulnerability

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119374
EUVD
EUVD-2026-113785

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SQLite SQLite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap buffer overflow in SQLite versions before 3.54.0, specifically in the FTS5 extension's fts5DoSecureDelete() function. Attackers can craft a database file with a corrupted FTS5 index footer. When secure-delete is enabled and the attacker deletes from this corrupted index, it causes heap memory corruption and crashes the application.

Detection Guidance

Detecting this vulnerability requires checking the SQLite version in use. Run 'sqlite3 --version' to verify if your version is below 3.54.0. If it is, the system is vulnerable. Additionally, inspect database files using FTS5 extensions for corruption by attempting secure-delete operations on suspicious files.

Impact Analysis

This vulnerability allows attackers to crash applications using SQLite with FTS5 and secure-delete enabled. In worst cases, it could potentially lead to arbitrary code execution, though this is not explicitly confirmed. The impact is limited to systems processing maliciously crafted database files.

Mitigation Strategies

Upgrade SQLite to version 3.54.0 or later immediately. If upgrading is not possible, disable the FTS5 secure-delete feature by recompiling SQLite without it or avoid using FTS5 with secure-delete enabled. Remove any untrusted SQLite database files that may contain corrupted FTS5 indexes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart