Description
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SQLite SQLite
Default version status: unaffected
0 to < 3.54.0affected
References
- https://sqlite.org/bugs/info/2026-08-04T08:49:27Z ↗
- https://sqlite.org/src/info/a7f8c92f62 ↗
- https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80 ↗
- https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107 ↗
- https://sqlite.org/releaselog/3_54_0.html ↗
- https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge ↗
- https://github.com/sqlite/sqlite ↗
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists ↗