Ten vulnerabilities fixed in SQLite 3.54.0 were published on
2026-10-30. Four of them corrupt the heap: buffer overflows in
the FTS5 functions fts5MergeRowidLists() and
fts5DoSecureDelete() and in the session extension
sessionUpdateFind(), and a use-after-free in the R-Tree function
nodeWrite(). A fifth, a use-after-free in the FTS3 function
fts3BestSnippet(), is reached through snippet().
The remaining five crash the process or leak data: unbounded
recursion through a chain of common table expressions, through a
chain of COLLATE operators and through countOfViewOptimization()
in a VALUES clause, an information leak on a page size mismatch
in the write-ahead log, and an authorizer bypass with RIGHT or
FULL JOIN USING.
An attacker has to supply a database file or SQL text, so the
FTS5 and FTS3 issues apply wherever those options are built in;
both are on by default in databases/sqlite3.