CVE-2026-119373 in SQLite
Summary
by MITRE • 10/30/2026
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in SQLite versions prior to 3.54.0 involves a critical heap buffer overflow within the Full-Text Search version five extension, specifically affecting operations that utilize detail=none prefix doclists. This flaw resides in the fts5MergeRowidLists function, which is responsible for merging row ID lists during query execution. The root cause of this issue stems from an incorrect calculation of output buffer sizes when handling specific edge cases involving negative row identifiers. When a database table configured with FTS5 and detail=none settings contains entries associated with negative rowids, the internal logic fails to account for the full extent of data required during the merge operation. Consequently, the allocated memory buffer is undersized relative to the actual volume of data being processed, leading to an out-of-bounds write condition where subsequent bytes are written beyond the boundaries of the allocated heap segment.
From a technical perspective, this vulnerability allows attackers who possess the ability to populate or modify FTS5 tables with negative rowids to trigger the overflow through prefix MATCH queries. The exploitation vector relies on the attacker controlling the input data structure within the database schema and executing specific search patterns that invoke the vulnerable merge routine. By crafting payloads that exploit the miscalculation, an adversary can overwrite adjacent heap memory structures. This corruption of heap metadata or neighboring objects typically results in immediate process termination due to segmentation faults or general protection violations. However, depending on the underlying allocator implementation and memory layout, such buffer overflows may also be leveraged for more severe outcomes, including arbitrary code execution if the attacker can precisely control the overwritten data and redirect program flow through function pointers or return addresses located within the corrupted heap region.
The operational impact of this vulnerability is significant for any application relying on SQLite with FTS5 enabled for text search capabilities, particularly those that allow user-supplied input to influence table contents or query parameters without rigorous validation. The immediate consequence is a denial of service through process crash, which disrupts availability and can lead to data loss if transactions are not properly handled during the fault condition. In environments where SQLite serves as an embedded database for critical services, such instability undermines system reliability and trustworthiness. Furthermore, while the primary manifestation described involves memory corruption leading to crashes, the underlying heap overflow nature of the flaw places it in a category that historically poses risks beyond simple denial of service, warranting immediate remediation regardless of whether remote code execution is confirmed as feasible in all deployment contexts.
Mitigation strategies primarily involve upgrading SQLite to version 3.54.0 or later, where this specific calculation error has been corrected by the development team. For applications unable to upgrade immediately due to compatibility constraints, defensive coding practices should be implemented to restrict the types of rowids accepted during data insertion into FTS5 tables with detail=none settings. Input validation mechanisms that filter out negative integers for primary keys or identifiers associated with full-text search indices can serve as a temporary workaround to prevent triggering the vulnerable code path. Additionally, enabling Address Sanitizer (ASan) in development environments and employing heap protection features such as stack canaries or Data Execution Prevention in production deployments may help detect or mitigate exploitation attempts by identifying memory corruption events early.
This vulnerability is classified under Common Weakness Enumeration CWE-122, which denotes a heap-based buffer overflow resulting from writing data beyond the allocated boundary of a heap object. In terms of tactical mapping within the MITRE ATT&CK framework, this flaw aligns with techniques related to exploitation for privilege escalation or denial of service, specifically falling under categories that involve memory corruption exploits such as CWE-120 Buffer Copy without Checking Size of Input in C/C++. The attack pattern corresponds to initial access vectors where an adversary interacts directly with the application interface to trigger internal logic flaws. Security teams should prioritize patching this component within their SQLite dependencies and conduct audits on any custom implementations that interact with FTS5 structures to ensure no similar assumptions about rowid positivity or buffer sizing exist elsewhere in the codebase.