7.2
High
CVE-2025-6965 Integer Truncation on SQLite
Description
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:GreenExploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- Low
- Interaction
- None
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
- Confidentiality of other systems
- Low
- Integrity of other systems
- High
- Availability of other systems
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SQLite 3.50 | earliest → < 3.50.2 | 3.50.2 |
| RUGGEDCOM CROSSBOW Station Access Controller (SAC) 6.0 | earliest → < 6.0 | 6.0 |
| SIDIS Prime 4.0 | earliest → < 4.0.800 | 4.0.800 |
References
- www.sqlite.org www.sqlite.org
Timeline
- Published
- Last modified
Other CVEs of SQLite
The 18 CVEs of SQLite →
CVE-2026-119591
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
6.8
Medium
CVE-2026-119586
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits…
8.5
High
CVE-2026-119379
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in…
8.5
High
CVE-2026-119378
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make…
6.8
Medium