CVE-2026-119374 in SQLite
Summary
by MITRE • 10/30/2026
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in SQLite versions prior to 3.54.0 specifically affects builds compiled with Full-Text Search version five support enabled. This flaw manifests as a heap buffer overflow within the fts5DoSecureDelete function, which is responsible for handling secure deletion operations on FTS5 indices. Secure delete mode in SQLite ensures that deleted data is overwritten rather than simply marked as free space, thereby preventing recovery of sensitive information from unallocated database pages. However, when this feature interacts with a corrupted or maliciously crafted FTS5 index structure, the internal logic fails to properly validate offsets derived from the footer key metadata. This lack of rigorous bounds checking allows an attacker to supply specific values that cause the application to write data beyond the allocated boundaries of the leaf page buffer in memory.
The technical root cause lies in the insufficient validation of offset parameters extracted from the FTS5 index header and footer structures during the secure deletion process. When a database file containing a malformed FTS5 index is processed, the function calculates memory addresses based on these offsets without verifying that they remain within the valid range of the allocated heap buffer. Consequently, an attacker can craft a SQLite database with carefully constructed corruption in the FTS5 metadata to manipulate these calculations. Upon execution of a delete operation targeting records associated with this corrupted index while secure-delete is enabled, the application performs out-of-bounds writes into adjacent memory regions on the heap. This behavior constitutes a classic buffer overflow vulnerability where control over write operations can potentially lead to arbitrary code execution or denial of service depending on the specific memory layout and exploitation context.
The operational impact of this vulnerability primarily centers around availability and potential integrity compromise through crash conditions. In most typical deployment scenarios, the immediate result is an application crash due to segmentation faults triggered by invalid memory access attempts. This provides a straightforward path for Denial of Service attacks against services that process untrusted SQLite databases with FTS5 enabled. However, given the nature of heap buffer overflows, there exists a theoretical risk of more severe consequences if the overflow allows for precise control over adjacent memory structures such as function pointers or object headers. While exploitation for remote code execution requires complex conditions and specific runtime environments, the mere ability to crash applications processing user-supplied database files represents a significant security concern for any system relying on SQLite for data storage with full-text search capabilities enabled.
Mitigation strategies focus primarily on upgrading to patched versions of SQLite where this issue has been resolved through improved input validation within the fts5DoSecureDelete routine. Developers and administrators should ensure that all instances of SQLite are updated to version 3.54.0 or later, which includes fixes for this specific heap overflow condition. Additionally, organizations processing external database files should implement strict sanitization protocols before loading them into applications using FTS5 features. Input validation at the application layer can serve as a defense-in-depth measure by verifying the integrity of index structures prior to performing destructive operations like secure deletion. Furthermore, enabling Address Sanitizer during development and testing phases can help detect such memory corruption issues early in the software lifecycle.
From an industry standard perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input, as it involves writing data beyond buffer boundaries due to inadequate size verification. It also relates to CWE-787 Out-of-bounds Write, highlighting the critical nature of memory safety in low-level database engines. In terms of adversarial tactics, this flaw could be leveraged within ATT&CK technique T1499 Endpoint Denial of Service if used solely for crashing applications, or potentially T1203 Exploitation for Credential Access or Code Execution if successfully exploited to gain higher privileges on the host system. Security teams should prioritize patching affected systems and review application logic surrounding database file ingestion to minimize exposure to crafted inputs that trigger this memory corruption flaw.