CVE-2026-119373 — Vulnerability intelligence

sqlite — sqlite

Published: 2026-10-30T12:16:36.027

CVSS

8.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.

Sources

• CVE-2026-119373
• Exploit, Third Party Advisory
• Product
• Patch
• Patch
• Issue Tracking, Patch, Vendor Advisory
• Release Notes
• Patch, Vendor Advisory
• Third Party Advisory