SQLite: Heap buffer overflow in FTS5 extension (CVE-2026-119373)

SQLite versions before 3.54.0, when the FTS5 full-text search extension is enabled, contain a heap buffer overflow in the fts5MergeRowidLists function. The vulnerability arises from an incorrect buffer size calculation when merging doclists where the detail level is set to 'none'. Successful exploitation requires an attacker to populate an FTS5 table with negative row identifiers and subsequently execute a prefix MATCH query. This condition triggers the buffer overflow, resulting in heap memory corruption or a process crash.

Impact

Observed impact is limited to heap memory corruption and application process crashes. While heap-based overflows can sometimes lead to arbitrary code execution, this specific vulnerability is primarily documented as a crash/denial-of-service condition at this time.

Recommendation

• Upgrade SQLite to version 3.54.0 or later to include the patch for CVE-2026-119373.
• Audit applications that utilize the SQLite FTS5 extension, particularly those that accept untrusted input for table creation or query construction, to determine if they are running a vulnerable version.