Memory Corruption Vulnerability in SQLite3 - CVE-2025-6965
Summary
CVE-2025-6965: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. Affects sqlite across 2 version ranges.
< 3.48.0-r3
< 9d7c5df7f0e42528bf514b5231d58273bea47e40
Fixed in 3.48.0-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite3 is a widely used database engine that provides a lightweight, serverless, self-contained SQL database. It is known for its simplicity and efficiency, making it a popular choice for applications ranging from mobile apps to web browsers. However, certain versions of SQLite3 are vulnerable to a memory corruption issue due to improper handling of aggregate terms, which can lead to significant security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-6965 exists in SQLite versions prior to 3.50.2. It arises from the potential for the number of aggregate terms in a query to exceed the number of available columns. This discrepancy can lead to memory corruption, which may allow an attacker to execute arbitrary code or crash the application. The issue is particularly concerning as it can compromise the integrity and confidentiality of the data managed by the database.
How To Fix
Minimum fixed version
3.48.0-r3
This is the first release that contains the fix.
sudo apk add --upgrade sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the use of aggregate functions in your SQL queries until the upgrade is completed. This may help mitigate the risk of triggering the vulnerability while you work on applying the fix.
Conclusion
CVE-2025-6965 represents a significant security risk for applications using vulnerable versions of SQLite3. It is crucial to upgrade to the patched version to protect against potential memory corruption and its associated consequences. Regular monitoring for vulnerabilities, such as through tools like Vulert, can help maintain application security.
See every vulnerability recorded for sqlite →
FAQ
CVE-2025-6965 is a vulnerability in SQLite3 that can lead to memory corruption due to improper handling of aggregate terms.
SQLite3 versions prior to 3.50.2 are affected by this vulnerability.
Exploiting this vulnerability could allow an attacker to execute arbitrary code or crash the application, compromising data integrity and confidentiality.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Upgrade SQLite3 to version 3.50.2 or above as soon as possible to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
