p PatchFirst

CVE-2025-7709

CVE-2025-7709 · Out Of Bounds write in FTS5 Extension in SQLite

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An integer overflow exists in the FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.

CVSS 6.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • fts5

    Versions
    • 3.49.1 < 3.50: Affected

    No fix published

  • sqlite3 Debian:12

    Versions
    • 3.40.1-2
    • 3.40.1-2+deb12u1
    • 3.40.1-2+deb12u2
    • 3.42.0-1
    • 3.43.0-1
    • 3.43.1-1
    • 3.43.2-1
    • 3.44.0-1
    • 3.44.2-1
    • 3.45.0-1
    • 3.45.1-1
    • 3.45.2-1
    • 3.45.3-1
    • 3.45.3-2~exp1
    • 3.46.0-1
    • 3.46.1-1
    • 3.46.1-2
    • 3.46.1-2~exp
    • 3.46.1-3
    • 3.46.1-4
    • 3.46.1-5
    • 3.46.1-6
    • 3.46.1-7
    • 3.46.1-8
    • 3.46.1-9
    • 3.53.2-1
    • 3.53.3-1
    • 3.53.4-1
    • 3.53.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sqlite3 Debian:13

    Versions
    • 3.46.1-7
    Affected ranges
    • ECOSYSTEM: < 3.46.1-7+deb13u1

    Update to 3.46.1-7+deb13u1

  • sqlite3 Debian:14

    Versions
    • 3.46.1-7
    Affected ranges
    • ECOSYSTEM: < 3.46.1-8

    Update to 3.46.1-8

  • sqlite3 Ubuntu:24.04:LTS

    Versions
    • 3.42.0-1
    • 3.44.0-1
    • 3.44.2-1
    • 3.45.0-1
    • 3.45.1-1
    • 3.45.1-1ubuntu1
    • 3.45.1-1ubuntu2
    • 3.45.1-1ubuntu2.1
    • 3.45.1-1ubuntu2.3
    • 3.45.1-1ubuntu2.4
    Affected ranges
    • ECOSYSTEM: < 3.45.1-1ubuntu2.5

    Update to 3.45.1-1ubuntu2.5

Original sources

Check your server →