SQLite FTS5 CVE-2026-119373

Requires a build of SQLite that includes the FTS5 extension, an FTS5 virtual table created with the non-default detail=none option, the attacker's ability to insert rows carrying negative rowids (the regression test uses -9223372036854775808), and the ability to run a prefix MATCH query (e.g. 'a*') against that table. Limiting factors: FTS5 is an optional compile-time extension and detail=none is a non-default table configuration, so default SQLite deployments without such a table are not exposed; the CVSS vector is AV:L, so the attacker needs local SQL-execution capability against the table rather than remote unauthenticated reach; and only versions before 3.54.0 are affected. Applications that never expose a detail=none FTS5 table to attacker-controlled rowids and queries are not exploitable.

The input CVSS 4.0 base score is 8.5 (HIGH), but the vector itself tempers the headline number: AV:L means this is a local/SQL-access flaw, not a remotely reachable network vulnerability. Exploitation requires an attacker who can already run crafted SQL (create or use a detail=none FTS5 table, insert rows with negative rowids, and issue a prefix MATCH query), so the realistic attacker population is whoever can submit arbitrary SQL or controlled content into an FTS5-enabled application. There is no CISA KEV listing (so not confirmed actively exploited) and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. A public research writeup exists (abraxaslabs.tech) describing the bug, but the input does not mark it as 'Publicly available (confirmed)' exploit code, so it should be treated as a public PoC/research reference that is not verified as working exploit code. A conflict worth flagging: the vendor-supplied vector rates full VC:H/VI:H/VA:H (complete confidentiality, integrity and availability impact), yet the description only demonstrates heap memory corruption and a process crash - i.e. denial of service - with no demonstrated information disclosure; the H/H/H rating reflects the theoretical potential of a CWE-787 out-of-bounds write rather than demonstrated code execution or data theft, so verify before treating this as a confirmed RCE. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency, patch-promptly posture rather than drop-everything urgency.

An attacker who can execute SQL against an application's SQLite database creates or uses a detail=none FTS5 virtual table, inserts a row with a very negative rowid (e.g. -9223372036854775808), then runs a prefix MATCH query such as 'a*'; merging the prefix doclists overflows the undersized output buffer in fts5MergeRowidLists(), corrupting the heap and crashing the process. A public research writeup describing the flaw exists, but the input does not confirm weaponized working exploit code. Because the CVSS vector is AV:L, this is a local/SQL-access scenario rather than unauthenticated remote exploitation.