SQLite FTS5 Prefix-Merge Flaw Causes Heap Buffer Overflow

A heap-buffer-overflow vulnerability in SQLite’s FTS5 full-text search extension can cause an out-of-bounds write when a table configured with detail=none processes a crafted prefix MATCH query. The affected function, fts5MergeRowidLists(), allocates space based on the combined encoded sizes of two input rowid lists, but merging delta-encoded rowids can increase their encoded size. A bug-forum reproducer requires 72 bytes where only 64 are allocated. Abraxas Labs demonstrated the issue in SQLite 3.53.4, while a separate SQLite bug report identifies version 3.54.0 and a specific source check-in as affected.

AddressSanitizer testing demonstrated memory corruption and process termination, but not remote code execution or an arbitrary-write primitive. Abraxas Labs rated the issue High, CVSS 3.1 7.5, with no CVE assigned at publication, and reported that Dan Kennedy had fixed it on trunk and the 3.53 branch; the tested 3.53.4 release lacked that fix. Exposure depends on whether an embedding application permits attacker-controlled SQL or database files to reach the affected FTS5 functionality. Organizations should inventory embedded SQLite deployments, verify that their shipped build includes the correction rather than relying solely on version labels, and restrict untrusted database and query inputs.