Vulnerability · Published Jul 29, 2025 · Assigned by Google
CVE-2025-7458SQLite integer overflow in key info allocation may lead to information disclosure.
Medium 6.9
In plain English
A medium-severity integer overflow in SQLite from SQLite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sqlite3 | no fix listed | DEBIAN-CVE-2025-7458 |
| Debian:13 | sqlite3 | 3.42.0-1 | DEBIAN-CVE-2025-7458 |
| Debian:14 | sqlite3 | 3.42.0-1 | DEBIAN-CVE-2025-7458 |
| Ubuntu:22.04:LTS | sqlite | no fix listed | UBUNTU-CVE-2025-7458 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N