AZL-111769: CVE-2026-119373 affecting package sqlite 3.44.0-4

Q: Which deployments are exposed?

SQLite builds with FTS5 enabled are affected before version 3.54.0. Exploitation specifically requires a detail=none FTS5 table using prefix doclists.

Q: What access does an attacker need to exploit this issue?

An attacker must be able to populate the affected FTS5 table with negative rowids and execute a prefix MATCH query. The described result is a heap out-of-bounds write that can corrupt memory and crash the process.

Q: How can I determine whether my application is affected?

Check whether it uses SQLite before 3.54.0 with FTS5 enabled, and whether it has detail=none FTS5 tables that accept or can be populated with negative rowids and are queried using prefix MATCH searches.

Published Oct 30, 2026

Updated

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.

Affected Software

1 affected component

azure-linux/sqlite<=3.44.0-4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade sqlite to a version that resolves this vulnerability.
Fixed in 3.54.0

Event History

Oct 30, 2026

Advisory Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119373

Frequently Asked Questions

Which deployments are exposed?

SQLite builds with FTS5 enabled are affected before version 3.54.0. Exploitation specifically requires a detail=none FTS5 table using prefix doclists.

What access does an attacker need to exploit this issue?

An attacker must be able to populate the affected FTS5 table with negative rowids and execute a prefix MATCH query. The described result is a heap out-of-bounds write that can corrupt memory and crash the process.

How can I determine whether my application is affected?

Check whether it uses SQLite before 3.54.0 with FTS5 enabled, and whether it has detail=none FTS5 tables that accept or can be populated with negative rowids and are queried using prefix MATCH searches.

AZL-111769: CVE-2026-119373 affecting package sqlite 3.44.0-4

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to exploit this issue?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to exploit this issue?

How can I determine whether my application is affected?