Memory Corruption Vulnerability in SQLite Package - CVE-2025-6965
Summary
UBUNTU-CVE-2025-6965: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. Affects sqlite versions 2.8.17-10ubuntu2 – 2.8.17-9fakesync1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a widely used database engine that provides a lightweight, serverless, self-contained SQL database engine. It is commonly embedded in applications and is known for its simplicity and efficiency. However, certain versions of SQLite are vulnerable to a memory corruption issue due to improper handling of aggregate terms, which can lead to significant security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-6965 affects SQLite versions prior to 3.50.2. It arises from the potential for the number of aggregate terms to exceed the number of available columns, leading to memory corruption. This can allow an attacker to exploit the vulnerability, potentially leading to arbitrary code execution or data corruption. The issue is particularly concerning as it can compromise the integrity and availability of applications relying on SQLite for data management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, if upgrading is not immediately possible, consider limiting the number of aggregate terms in your SQL queries to avoid triggering the vulnerability. However, this is not a permanent solution and upgrading is strongly advised.
Conclusion
In summary, CVE-2025-6965 is a critical vulnerability in SQLite that can lead to memory corruption. It is essential for users of affected versions to upgrade to version 3.50.2 or later to mitigate the risks associated with this vulnerability. Regular monitoring and updates are crucial for maintaining application security.
See every vulnerability recorded for sqlite →
FAQ
CVE-2025-6965 is a vulnerability in SQLite that can lead to memory corruption due to improper handling of aggregate terms.
SQLite versions prior to 3.50.2 are affected by this vulnerability.
Exploitation of this vulnerability can lead to memory corruption, which may result in arbitrary code execution or data corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, limit the number of aggregate terms in your SQL queries as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
