CVE-2025-6965

CVE-2025-6965 is a numeric handling flaw (CWE-197) in SQLite versions before 3.50.2 in which the number of aggregate terms in a query can exceed the number of available columns, resulting in memory corruption. An attacker triggers it by getting an application that embeds SQLite to execute crafted SQL: the vector is network-based and requires only low privileges, but with high attack complexity (CVSS 4.0 base 7.2), and successful corruption carries high integrity impact on the running process. Because SQLite is embedded in countless applications and operating systems, every deployment running SQLite older than 3.50.2 is affected, including Apple's iPhone OS, iPadOS, macOS, tvOS, visionOS and watchOS and Siemens' RUGGEDCOM CROSSBOW and SIDIS Prime, which bundle the library. The flaw is not on the CISA KEV list and no public proof-of-concept is known, but Google reported that its Big Sleep AI discovered the bug as hackers were preparing to exploit it, and EPSS assigns a 75.8% probability of exploitation within 30 days.

What to do: Upgrade SQLite to version 3.50.2 or later in every bundled or embedded deployment, and apply the corresponding Apple OS and Siemens RUGGEDCOM CROSSBOW/SIDIS Prime updates as vendors publish fixed releases. Inventory which applications, devices and internet-facing services ship vulnerable SQLite and prioritize anything that processes untrusted SQL, given the very high EPSS score (75.8% within 30 days) and Google's report that attackers were preparing to exploit this bug. Where patching is delayed, review aggregate SQL queries for cases where aggregate terms exceed available columns as a triage measure.