Vulnerability · Published Sep 8, 2025 · Assigned by Google
CVE-2025-7709Out Of Bounds write in FTS5 Extension in SQLite
Medium 6.9
In plain English
A medium-severity integer overflow in FTS5 from SQLite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.4%top 68.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An integer overflow exists in the FTS5 https://sqlite.org/fts5.html extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sqlite3 | no fix listed | DEBIAN-CVE-2025-7709 |
| Debian:13 | sqlite3 | 3.46.1-7+deb13u1 | DEBIAN-CVE-2025-7709 |
| Debian:14 | sqlite3 | 3.46.1-8 | DEBIAN-CVE-2025-7709 |
| Ubuntu:24.04:LTS | sqlite3 | 3.45.1-1ubuntu2.5 | USN-7751-1 |
| Ubuntu:24.04:LTS | sqlite3 | 3.45.1-1ubuntu2.5 | UBUNTU-CVE-2025-7709 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L