PT-2025-36479 · Sqlite +1 · Sqlite Fts5 +1

Published 2025-01-01 · Updated 2025-09-08 · CVE-2025-7709

Positive Technologies · (AI Summary)

CVSS v4.0

6.9

6.9

Medium

Base vector

AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions:

SQLite FTS5 extension (affected versions not specified)

Description:

An integer overflow exists in the FTS5 extension. The issue occurs when calculating the size of an array of tombstone pointers, leading to truncation into a 32-bit integer. This allows writing a pointer to partially controlled data out of bounds.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2025-7709

Affected Products

Debian

Sqlite Fts5

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7709 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-7709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7709 · Security Note
• https://security-tracker.debian.org/tracker/source-package/sqlite3 · Vendor Advisory
• https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g · Note
• https://packages.debian.org/src:sqlite3 · Note
• https://twitter.com/CVEnew/status/1965071492984488049 · Twitter Post