CVE-2026-119373High· 7.8▾ TwilightSQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative r…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
SQLite < 3.54.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119591Medium· 5.5SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
CVE-2026-119377Low· 2.5SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
CVE-2026-119376Medium· 5.5SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
CVE-2026-119372Medium· 5.5SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
CVE-2020-15358Medium· 5.5In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
CVE-2026-11824High· 7.8SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation …