{"id":"AZL-111769","summary":"CVE-2026-119373 affecting package sqlite 3.44.0-4","details":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.","modified":"2026-10-31T14:17:40.546910650Z","published":"2026-10-30T12:16:36Z","upstream":["CVE-2026-119373"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373"}],"affected":[{"package":{"name":"sqlite","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/sqlite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.44.0-4"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111769.json"}}],"schema_version":"1.9.2"}