SQLite libraries built with the FTS5 extension before version 3.54.0 contain a heap buffer overflow in the function fts5MergeRowidLists(). The flaw occurs when the function merges detail=none prefix doclists that contain negative rowid values, undersizing the output buffer and allowing an attacker to write past the allocated memory. This memory corruption can lead to process crashes and, in some contexts, elevate the effect to more severe failures, but the CVE description does not assert that arbitrary code execution is guaranteed.

The vulnerability affects all installations of SQLite that include the FTS5 extension and are built with a version earlier than 3.54.0. Supported vendors: SQLite, SQLite developers. All compiled binaries of SQLite prior to 3.54.0 that expose the FTS5 feature are at risk. No specific patch versions are listed beyond the release that includes the fix, which is 3.54.0 and later.

The CVSS score of 8.5 reflects a high severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, so public exploit data are currently unknown. The likely attack vector is an application that can write negative rowid values into a detail=none FTS5 table and then issue a prefix MATCH query that triggers the merge. If the database is exposed to untrusted input, remote exploitation may be possible; if it is only accessed locally, exploitation requires application-level access. The exploit requires that the vulnerable code path be active, meaning the FTS5 extension is compiled in and detail=none usage is enabled.