SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()

Summary

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.

Remediation

1. Inventory every SQLite SQLite deployment, including staging.
2. Upgrade SQLite SQLite to 3.54.0.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107
• Patchhttps://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80
• Patchhttps://sqlite.org/bugs/info/2026-08-04T08:49:27Z
• Patchhttps://sqlite.org/src/info/a7f8c92f62
• Advisoryhttps://abraxaslabs.tech/research/sqlite-fts5-rowidmerge
• Advisoryhttps://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists
• Referencehttps://github.com/sqlite/sqlite
• Referencehttps://sqlite.org/releaselog/3_54_0.html