SQLite versions prior to 3.54.0 contain a heap buffer overflow in the fts5DoSecureDelete() function of the FTS5 extension. The flaw occurs when crafted footer key offsets allow an attacker to write beyond the leaf page buffer, corrupting heap memory. This can lead to application crashes and potential data loss, but the description does not indicate arbitrary code execution. The weakness is classified as CWE-787.

The vulnerability affects all installations of SQLite that include the FTS5 extension and are built with a version earlier than 3.54.0. This includes the standard SQLite library distributed for many platforms, regardless of operating system, identified by the CPE cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*. The product name is SQLite.

The CVSS score of 8.5 indicates a high severity risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits at this time. The attack requires the ability to supply a maliciously crafted database file to an application that uses SQLite with secure-delete enabled for FTS5. It is likely to be a local attack vector if the application manipulates untrusted or externally-provided database files, or an indirect remote vector if an attacker can influence a database file used by the system.