Sqlite CVE-2025-6965

SQLite is an embedded relational database engine widely deployed in applications, mobile devices, browsers, and industrial systems. This vulnerability (CWE-197: Numeric Truncation Error) occurs in the SQL aggregate function processing logic where the database engine fails to properly validate that the count of aggregate terms does not exceed the number of columns available in the result set. When this boundary condition is violated, the mismatch triggers out-of-bounds memory access during query execution. The affected component is the SQLite core library (cpe:2.3:a:sqlite:sqlite) used across countless downstream products. The CVSS vector indicates network attack capability (AV:N) but requires authenticated access (PR:L) and has high attack complexity (AC:H) with partial attack complexity timing (AT:P), suggesting specific query construction knowledge is needed. The vulnerability enables high integrity impact to vulnerable (VI:H) and subsequent (SI:H) systems, indicating potential for data manipulation or corruption across application boundaries.