SQLite fixes three heap overflows in 3.54.0, CLI recover flaw open

SQLite fixes three heap overflows in 3.54.0, CLI recover flaw open

2 November 2026: Four SQLite flaws published on 30 October, each scored 8.5 under CVSS 4.0, reach the library's FTS5 full-text index, its session extension and the command-line shell. Three are heap buffer overflows that SQLite 3.54.0 already fixes; the fourth, a command injection in the shell's .recover command, is recorded as affecting every release through 3.54.1, the current one. Italy's national cybersecurity agency, ACN, issued an alert on the set on 2 November.

Not yet independently verified. SQLite's own CVE page was last updated in August and does not yet list these records, and no fixed release is named for the .recover flaw (CVE-2026-119586). We have seen no report of exploitation. We will update this when it can be confirmed, and remove this note.

The four flaws

VulnCheck, acting as the numbering authority, published the records with links to the SQLite check-ins that fix three of them:

• CVE-2026-119373: heap overflow in fts5MergeRowidLists() when merging prefix doclists in an FTS5 table created with detail=none; an attacker who can add rows with negative rowids and run a prefix query undersizes the output buffer. Fixed in 3.54.0.
• CVE-2026-119374: heap overflow in fts5DoSecureDelete() through crafted footer key offsets in a corrupted FTS5 index, triggered when rows are deleted. Fixed in 3.54.0.
• CVE-2026-119379: heap overflow in sqlite3changeset_apply() in builds with the session extension, reached by a changeset that repeats a table name. Fixed in 3.54.0.
• CVE-2026-119586: the shell's .recover command writes dot-commands stored in sqlite_schema values into its output verbatim, so a crafted database can plant commands that run when the recovered output is replayed. Listed through 3.54.1, with no fixed version given.

ACN's alert describes the possible effects as arbitrary code execution, data manipulation and denial of service, and rates the systemic impact as medium.

Fixed versions

SQLite 3.54.0 came out on 9 October and 3.54.1, which fixes a heap overflow on 32-bit builds and other 3.54.0 problems, on 16 October. Upgrading to 3.54.1 closes the three memory-safety flaws. The .recover issue sits in the CLI tool rather than the library most applications embed, so it matters mainly where staff or scripts run .recover on databases that came from outside.

Where the exposure really is

SQLite is compiled into far more products than ever list it, from mobile apps and browsers to device firmware and desktop software, and many ship their own copy rather than the system library. The FTS5 and session flaws need those features compiled in and an attacker able to supply a database file or a changeset. Software that opens user-supplied SQLite files, synchronises changesets between devices, or indexes untrusted text with FTS5 is the case to check first. Until a fix for .recover exists, treat recovered output from an untrusted file as code and read it before replaying it.

Our catalogue lists SQLite among 35 relational database products.

Sources

• ACN / CSIRT Italia: Rilevate vulnerabilità in SQLite (AL04/261102/CSIRT-ITA), 2 November 2026
• CVE record CVE-2026-119586 (VulnCheck CNA), 30 October 2026
• CVE record CVE-2026-119379 (VulnCheck CNA), 30 October 2026
• CVE records CVE-2026-119374 and CVE-2026-119373 (VulnCheck CNA), 30 October 2026
• SQLite: Release history (3.54.0 of 9 October, 3.54.1 of 16 October), 16 October 2026