Vulnerability · Published Jul 15, 2025 · Assigned by Google
CVE-2025-6965Integer Truncation on SQLite
High 7.2
In plain English
A high-severity security flaw in SQLite from SQLite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 73.5% (higher than 99.5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)7.2High
Exploit odds (30 days)73.5%top 0.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | lemon | 3.26.0-20.el8_10 | ALSA-2025:12010 |
| AlmaLinux:8 | mingw32-sqlite | 3.26.0.0-2.el8_10 | ALSA-2025:14101 |
| AlmaLinux:8 | mingw32-sqlite-static | 3.26.0.0-2.el8_10 | ALSA-2025:14101 |
| AlmaLinux:8 | mingw64-sqlite | 3.26.0.0-2.el8_10 | ALSA-2025:14101 |
| AlmaLinux:8 | mingw64-sqlite-static | 3.26.0.0-2.el8_10 | ALSA-2025:14101 |
| AlmaLinux:8 | nodejs | 1:22.16.0-2.module_el8.10.0+4028+97ddca84 | ALSA-2025:11803 |
| AlmaLinux:8 | nodejs-devel | 1:22.16.0-2.module_el8.10.0+4028+97ddca84 | ALSA-2025:11803 |
| AlmaLinux:8 | nodejs-docs | 1:22.16.0-2.module_el8.10.0+4028+97ddca84 | ALSA-2025:11803 |
| AlmaLinux:8 | nodejs-full-i18n | 1:22.16.0-2.module_el8.10.0+4028+97ddca84 | ALSA-2025:11803 |
| AlmaLinux:8 | nodejs-libs | 1:22.16.0-2.module_el8.10.0+4028+97ddca84 | ALSA-2025:11803 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3983+391a1a04 | ALSA-2025:11803 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.10.0+4006+3c416519 | ALSA-2025:11803 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.10.0+3961+6a788e57 | ALSA-2025:11803 |
| AlmaLinux:8 | npm | 1:10.9.2-1.22.16.0.2.module_el8.10.0+4028+97ddca84 | ALSA-2025:11803 |
| AlmaLinux:10 | sqlite | 3.46.1-5.el10_0 | ALSA-2025:11933 |
| AlmaLinux:8 | sqlite | 3.26.0-20.el8_10 | ALSA-2025:12010 |
| AlmaLinux:9 | sqlite | 3.34.1-9.el9_7 | ALSA-2025:20936 |
| AlmaLinux:9 | sqlite | 3.34.1-8.el9_6 | ALSA-2025:11992 |
| AlmaLinux:10 | sqlite-devel | 3.46.1-5.el10_0 | ALSA-2025:11933 |
| AlmaLinux:8 | sqlite-devel | 3.26.0-20.el8_10 | ALSA-2025:12010 |
| AlmaLinux:9 | sqlite-devel | 3.34.1-9.el9_7 | ALSA-2025:20936 |
| AlmaLinux:9 | sqlite-devel | 3.34.1-8.el9_6 | ALSA-2025:11992 |
| AlmaLinux:8 | sqlite-doc | 3.26.0-20.el8_10 | ALSA-2025:12010 |
| AlmaLinux:10 | sqlite-libs | 3.46.1-5.el10_0 | ALSA-2025:11933 |
| AlmaLinux:8 | sqlite-libs | 3.26.0-20.el8_10 | ALSA-2025:12010 |
| AlmaLinux:9 | sqlite-libs | 3.34.1-8.el9_6 | ALSA-2025:11992 |
| AlmaLinux:9 | sqlite-libs | 3.34.1-9.el9_7 | ALSA-2025:20936 |
| AlmaLinux:8 | v8-12.4-devel | 3:12.4.254.21-1.22.16.0.2.module_el8.10.0+4028+97ddca84 | ALSA-2025:11803 |
| Alpine:v3.22 | qt6-qtwebengine | 6.8.3-r4 | ALPINE-CVE-2025-6965 |
| Alpine:v3.23 | qt6-qtwebengine | 6.10.0-r1 | ALPINE-CVE-2025-6965 |
| Alpine:v3.24 | qt6-qtwebengine | 6.10.0-r1 | ALPINE-CVE-2025-6965 |
| Alpine:v3.20 | sqlite | 3.45.3-r3 | ALPINE-CVE-2025-6965 |
| Alpine:v3.21 | sqlite | 3.48.0-r3 | ALPINE-CVE-2025-6965 |
| Alpine:v3.22 | sqlite | 3.49.2-r1 | ALPINE-CVE-2025-6965 |
| Debian:12 | sqlite3 | 3.40.1-2+deb12u2 | DEBIAN-CVE-2025-6965 |
| Debian:13 | sqlite3 | 3.46.1-7 | DEBIAN-CVE-2025-6965 |
| Debian:14 | sqlite3 | 3.46.1-7 | DEBIAN-CVE-2025-6965 |
| NuGet | sqlitepclraw.lib.e_sqlite3 | no fix listed | GHSA-2m69-gcr7-jv3q |
| NuGet | sqlitepclraw.lib.e_sqlite3.android | no fix listed | GHSA-2m69-gcr7-jv3q |
| NuGet | sqlitepclraw.lib.e_sqlite3.ios | no fix listed | GHSA-2m69-gcr7-jv3q |
| Rocky Linux:8 | mingw-sqlite | 0:3.26.0.0-2.el8_10 | RLSA-2025:14101 |
| Rocky Linux:8 | nodejs | 1:22.16.0-2.module+el8.10.0+2012+fb8b67c7 | RLSA-2025:11803 |
| Rocky Linux:9 | nodejs | 1:22.16.0-2.module+el9.6.0+32322+a8b1fd01 | RLSA-2025:11802 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1666+930e28e8 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1667+4a788d89 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1823+b5789597 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1924+614dc87f | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2025:11803 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2025:11802 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+1419+1f26ef47 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+1989+e60144d9 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+1988+437f3d23 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+1924+614dc87f | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+1824+532140ee | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+1823+b5789597 | RLSA-2025:11803 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+1667+4a788d89 | RLSA-2025:11803 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2025:11802 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2025:11802 |
| Rocky Linux:10 | sqlite | 0:3.46.1-5.el10_0 | RLSA-2025:11933 |
| Rocky Linux:8 | sqlite | 0:3.26.0-20.el8_10 | RLSA-2025:12010 |
| Rocky Linux:9 | sqlite | 0:3.34.1-9.el9_7 | RLSA-2025:20936 |
| Rocky Linux:9 | sqlite | 0:3.34.1-8.el9_6 | RLSA-2025:11992 |
| Ubuntu:22.04:LTS | sqlite3 | 3.37.2-2ubuntu0.5 | USN-7676-1 |
| Ubuntu:22.04:LTS | sqlite3 | 3.37.2-2ubuntu0.5 | UBUNTU-CVE-2025-6965 |
| Ubuntu:24.04:LTS | sqlite3 | 3.45.1-1ubuntu2.4 | UBUNTU-CVE-2025-6965 |
| Ubuntu:24.04:LTS | sqlite3 | 3.45.1-1ubuntu2.4 | USN-7676-1 |
| Ubuntu:25.10 | sqlite3 | 3.46.1-6ubuntu1 | UBUNTU-CVE-2025-6965 |
Affected products (as reported)
Weakness: CWE-197 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green
References
- https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8
- http://seclists.org/fulldisclosure/2025/Sep/57
- http://seclists.org/fulldisclosure/2025/Sep/56
- http://seclists.org/fulldisclosure/2025/Sep/53
- http://seclists.org/fulldisclosure/2025/Sep/58
- http://seclists.org/fulldisclosure/2025/Sep/49
- http://www.openwall.com/lists/oss-security/2025/09/06/1
- https://cert-portal.siemens.com/productcert/html/ssa-485750.html
- https://cert-portal.siemens.com/productcert/html/ssa-225816.html
- https://cert-portal.siemens.com/productcert/html/ssa-765416.html