synced 7 MIN AGO
01 Record

CVE-2025-6965

Integer Truncation on SQLite

HighPUBLISHEDCNA: Google
CNA base score7.2 CVSS v4.0CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green
View raw JSON

02 Description

Integer Truncation on SQLite

03 Exploitation and scoring

Exploitation
Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.
SSVC decision
  • ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
  • AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
  • Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.
EPSS probability
73.45% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 99.4% of scored records. A rank, not a probability.
NVD base score
7.2 (CVSS v4.0), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green
NVD analysis status
Modified. NVD last modified this record on 2026-10-15.
Red Hat severity
Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2025-07-15 13:44Z1 YR AGO
Last updated
2026-10-15 01:02Z15 DAYS AGO
Reserved
2025-07-01
Assigning CNA
Google
Record state
PUBLISHED
Severity
High (CVSS 7.2)
CNA CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green
Weaknesses
  • CWE-197Numeric Truncation ErrorBase
Data version
5.2
Document digest
48d5a5474aaa27fe1e8a0357e3e771690a367824aac1968a2c5a0d792b22351e

05 Affected products

VendorProductVersionsPlatforms
SQLiteSQLite0 to < 3.50.2—

06 References

07 Fixed in

AlmaLinux 8

  • lemon
    Fixed in 3.26.0-20.el8_10
  • mingw32-sqlite
    Fixed in 3.26.0.0-2.el8_10
  • mingw32-sqlite-static
    Fixed in 3.26.0.0-2.el8_10
  • mingw64-sqlite
    Fixed in 3.26.0.0-2.el8_10
  • mingw64-sqlite-static
    Fixed in 3.26.0.0-2.el8_10
  • nodejs
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-devel
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-docs
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-full-i18n
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-libs
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-nodemon
    Fixed in 3.0.1-1.module_el8.10.0+3983+391a1a04
  • nodejs-packaging
    Fixed in 2021.06-4.module_el8.10.0+4006+3c416519
  • nodejs-packaging-bundler
    Fixed in 2021.06-4.module_el8.10.0+3961+6a788e57
  • npm
    Fixed in 1:10.9.2-1.22.16.0.2.module_el8.10.0+4028+97ddca84
  • sqlite
    Fixed in 3.26.0-20.el8_10
  • sqlite-devel
    Fixed in 3.26.0-20.el8_10
  • sqlite-doc
    Fixed in 3.26.0-20.el8_10
  • sqlite-libs
    Fixed in 3.26.0-20.el8_10
  • v8-12.4-devel
    Fixed in 3:12.4.254.21-1.22.16.0.2.module_el8.10.0+4028+97ddca84

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

AlmaLinux 9

  • sqlite
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.34.1-8.el9_6
    • Affected before 3.34.1-9.el9_7
  • sqlite-devel
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.34.1-8.el9_6
    • Affected before 3.34.1-9.el9_7
  • sqlite-libs
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.34.1-8.el9_6
    • Affected before 3.34.1-9.el9_7

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

AlmaLinux 10

  • sqlite
    Fixed in 3.46.1-5.el10_0
  • sqlite-devel
    Fixed in 3.46.1-5.el10_0
  • sqlite-libs
    Fixed in 3.46.1-5.el10_0

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 8

  • lemon
    Fixed in 3.26.0-20.el8_10
  • mingw32-sqlite
    Fixed in 3.26.0.0-2.el8_10
  • mingw32-sqlite-static
    Fixed in 3.26.0.0-2.el8_10
  • mingw64-sqlite
    Fixed in 3.26.0.0-2.el8_10
  • mingw64-sqlite-static
    Fixed in 3.26.0.0-2.el8_10
  • nodejs
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-devel
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-docs
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-full-i18n
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-libs
    Fixed in 1:22.16.0-2.module_el8.10.0+4028+97ddca84
  • nodejs-nodemon
    Fixed in 3.0.1-1.module_el8.10.0+3983+391a1a04
  • nodejs-packaging
    Fixed in 2021.06-4.module_el8.10.0+4006+3c416519
  • nodejs-packaging-bundler
    Fixed in 2021.06-4.module_el8.10.0+3961+6a788e57
  • npm
    Fixed in 1:10.9.2-1.22.16.0.2.module_el8.10.0+4028+97ddca84
  • sqlite
    Fixed in 3.26.0-20.el8_10
  • sqlite-devel
    Fixed in 3.26.0-20.el8_10
  • sqlite-doc
    Fixed in 3.26.0-20.el8_10
  • sqlite-libs
    Fixed in 3.26.0-20.el8_10
  • v8-12.4-devel
    Fixed in 3:12.4.254.21-1.22.16.0.2.module_el8.10.0+4028+97ddca84

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 9

  • sqlite
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.34.1-8.el9_6
    • Affected before 3.34.1-9.el9_7
  • sqlite-devel
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.34.1-8.el9_6
    • Affected before 3.34.1-9.el9_7
  • sqlite-libs
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.34.1-8.el9_6
    • Affected before 3.34.1-9.el9_7

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 10

  • sqlite
    Fixed in 3.46.1-5.el10_0
  • sqlite-devel
    Fixed in 3.46.1-5.el10_0
  • sqlite-libs
    Fixed in 3.46.1-5.el10_0

Derived from AlmaLinux 10. Partial coverage: only packages taken from AlmaLinux 10 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

Debian 12

  • sqlite3
    Fixed in 3.40.1-2+deb12u2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

  • sqlite3
    Fixed in 3.46.1-7

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

  • sqlite3
    Fixed in 3.46.1-7

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

  • sqlite3
    Fixed in 3.37.2-2ubuntu0.5

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 24.04 LTS

  • sqlite3
    Fixed in 3.45.1-1ubuntu2.4

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 25.10

  • sqlite3
    Fixed in 3.46.1-6ubuntu1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

  • sqlite3
    Fixed in 3.8.2-1ubuntu2.2+esm5
    Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

  • sqlite3
    Fixed in 3.11.0-1ubuntu1.5+esm3
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 18.04 LTS

  • sqlite3
    Fixed in 3.22.0-1ubuntu0.7+esm2
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 20.04 LTS

  • sqlite3
    Fixed in 3.31.1-4ubuntu0.7+esm1
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.