Search: CVE-2026-119373

CVE-2026-119373 is a heap buffer overflow vulnerability in SQLite versions before 3.54.0 when built with FTS5. The flaw occurs in the fts5MergeRowidLists() function, which undersizes the output buffer when merging detail=none prefix doclists. An attacker able to insert negative rowids into a detail=none FTS5 table and execute a prefix MATCH query can trigger a heap memory corruption leading to process crashes.