Is CVE-2026-119374 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119374?

CVE-2026-119374 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-119374

Description

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.