CVE-2025-6965High· 7.7▾ MidnightPoC availableThere exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.4 · likelihood 14.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
74%
74% → 76%
Last analysed / modified upstream
Exploit-DB (last check)
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
sqlite < 3.50.2ipados < 26.0.0iphone_os < 26.0.0macos < 26.0.0tvos < 26.0.0visionos < 26.0.0watchos < 26.0.0ruggedcom_crossbow < 5.8sidis_prime < 4.0.800Upgrade past the affected range:
sqlite 3.50.2ipados 26.0.0iphone_os 26.0.0macos 26.0.0tvos 26.0.0visionos 26.0.0watchos 26.0.0ruggedcom_crossbow 5.8sidis_prime 4.0.800Connected by shared product, vendor, weakness, or advisory.
CVE-2026-11822High· 7.8SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with mal…
CVE-2026-11824High· 7.8SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation …
CVE-2025-70873High· 7.5An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
CVE-2019-19959High· 7.5ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
CVE-2019-20218High· 7.5selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
CVE-2019-19242Medium· 5.9SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.