CVE-2026-119373

A flaw was found in SQLite. A heap-based buffer overflow exists in the Full-Text Search 5 (FTS5) extension during the merging of prefix document lists. An attacker capable of inserting negative row identifiers into a configured table and executing a prefix search query can cause data to be written beyond allocated memory. This issue can lead to memory corruption, resulting in application crashes, a Denial of Service (DoS), or potentially arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.