{"id":"CVE-2025-7709","aliases":["BELL-CVE-2025-7709","DEBIAN-CVE-2025-7709","EUVD-2025-27137","GHSA-v2c8-vqqp-hv3g","ROOT-OS-DEBIAN-12-CVE-2025-7709","ROOT-OS-DEBIAN-13-CVE-2025-7709","SUSE-SU-2026:0395-1","SUSE-SU-2026:0432-1","SUSE-SU-2026:0955-1","SUSE-SU-2026:1065-1","SUSE-SU-2026:20771-1","SUSE-SU-2026:20794-1","SUSE-SU-2026:21095-1","SUSE-SU-2026:21173-1","UBUNTU-CVE-2025-7709","USN-7751-1","openSUSE-SU-2026:10171-1","openSUSE-SU-2026:20513-1"],"status":"published","title":"Out Of Bounds write in FTS5 Extension in SQLite","description":"An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00385,"percentile":0.32874,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2025-09-08T14:51:49Z","modified":"2026-11-03T12:15:08Z","fixes":[{"ecosystem":"Alpaquita:25","package":"sqlite","fixed_in":["3.50.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"sqlite","fixed_in":["3.50.3-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"sqlite","fixed_in":["3.50.3-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"sqlite","fixed_in":["3.50.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.46.1-7+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.46.1-8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"sqlite3","fixed_in":["3.40.1-2+deb12u2.root.io.8","3.40.1-2+deb12u2.root.io.7","3.40.1-2+deb12u2.root.io.6","3.40.1-2+deb12u2.root.io.9","3.40.1-2+deb12u2.root.io.10","3.40.1-2+deb12u2.aikido.11","3.40.1-2+deb12u2.aikido.12"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-sqlite3","fixed_in":["3.40.1-2+deb12u2.root.io.8","3.40.1-2+deb12u2.root.io.7","3.40.1-2+deb12u2.root.io.6","3.40.1-2+deb12u2.root.io.9","3.40.1-2+deb12u2.root.io.10","3.40.1-2+deb12u2.aikido.11","3.40.1-2+deb12u2.aikido.12"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"sqlite3","fixed_in":["3.51.2-9.44.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sqlite3","fixed_in":["3.51.2-150000.3.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"sqlite3","fixed_in":["3.51.2-150000.3.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"sqlite3","fixed_in":["3.51.2-150000.3.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"sqlite3","fixed_in":["3.51.2-150000.3.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sqlite3","fixed_in":["3.51.2-150000.3.36.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"sqlite3","fixed_in":["3.51.2-150000.3.36.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"sqlite3","fixed_in":["3.45.1-1ubuntu2.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","fixed_in":["3.51.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.49.2-r0"},{"fixed":"3.50.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.49.1-r0"},{"fixed":"3.50.3-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.49.2-r0"},{"fixed":"3.50.3-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.49.1-r0"},{"fixed":"3.50.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.1-2","3.40.1-2+deb12u1","3.40.1-2+deb12u2","3.42.0-1","3.43.0-1","3.43.1-1","3.43.2-1","3.44.0-1","3.44.2-1","3.45.0-1","3.45.1-1","3.45.2-1","3.45.3-1","3.45.3-2~exp1","3.46.0-1","3.46.1-1","3.46.1-2","3.46.1-2~exp","3.46.1-3","3.46.1-4","3.46.1-5","3.46.1-6","3.46.1-7","3.46.1-8","3.46.1-9","3.53.2-1","3.53.3-1","3.53.4-1","3.53.4-2"]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.1-7+deb13u1"}]}],"versions":["3.46.1-7"]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.46.1-8"}]}],"versions":["3.46.1-7"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-2+deb12u2.root.io.8"},{"fixed":"3.40.1-2+deb12u2.root.io.7"},{"fixed":"3.40.1-2+deb12u2.root.io.6"},{"fixed":"3.40.1-2+deb12u2.root.io.9"},{"fixed":"3.40.1-2+deb12u2.root.io.10"},{"fixed":"3.40.1-2+deb12u2.aikido.11"},{"fixed":"3.40.1-2+deb12u2.aikido.12"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-2+deb12u2.root.io.8"},{"fixed":"3.40.1-2+deb12u2.root.io.7"},{"fixed":"3.40.1-2+deb12u2.root.io.6"},{"fixed":"3.40.1-2+deb12u2.root.io.9"},{"fixed":"3.40.1-2+deb12u2.root.io.10"},{"fixed":"3.40.1-2+deb12u2.aikido.11"},{"fixed":"3.40.1-2+deb12u2.aikido.12"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.2-9.44.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.2-150000.3.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.2-150000.3.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.2-150000.3.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.2-150000.3.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.2-150000.3.36.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.2-150000.3.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-9.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-150000.3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-slfo.1.1_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45.1-1ubuntu2.5"}]}],"versions":["3.42.0-1","3.44.0-1","3.44.2-1","3.45.0-1","3.45.1-1","3.45.1-1ubuntu1","3.45.1-1ubuntu2","3.45.1-1ubuntu2.1","3.45.1-1ubuntu2.3","3.45.1-1ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45.1-1ubuntu2.5"}]}],"versions":["3.42.0-1","3.44.0-1","3.44.2-1","3.45.0-1","3.45.1-1","3.45.1-1ubuntu1","3.45.1-1ubuntu2","3.45.1-1ubuntu2.1","3.45.1-1ubuntu2.3","3.45.1-1ubuntu2.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.51.3-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"sqlite","product":"fts5"}],"references":[{"url":"https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g","tags":["advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/06/2"},{"url":"http://www.openwall.com/lists/oss-security/2025/11/18/10"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-7709","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-7709","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260395-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248586","tags":["report"]},{"url":"https://bugzilla.suse.com/1254670","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7709","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260432-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260955-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259619","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-70873","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261065-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620771-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620794-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621095-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1252217","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621173-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-7709","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-7709","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7751-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-7709","title":"Out Of Bounds write in FTS5 Extension in SQLite","description":"An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.","status":"published","published":"2025-09-08T14:51:49.065Z","modified":"2025-11-18T23:03:59.973Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:32:51.880027Z"}],"euvd":[{"id":"EUVD-2025-27137","description":"An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.","status":"published","published":"2025-09-08T14:51:49Z","modified":"2025-11-18T23:03:59Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"medium"}],"updated_at":"2026-11-02T19:49:15.429944Z"}],"nvd":[{"id":"CVE-2025-7709","description":"An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.","status":"published","published":"2025-09-08T15:15:38.18Z","modified":"2026-06-17T10:05:30.437Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:11:27.73916Z"}],"osv":[{"id":"DEBIAN-CVE-2025-7709","description":"An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.","status":"published","published":"2025-09-08T15:15:38.18Z","modified":"2026-09-01T20:04:41.951680652Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"UBUNTU-CVE-2025-7709","description":"An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.","status":"published","published":"2025-09-08T15:15:00Z","modified":"2026-04-22T16:16:31.949035Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"BELL-CVE-2025-7709","status":"published","published":"2025-09-09T06:05:53.712273Z","modified":"2026-01-26T09:41:04.15881Z","updated_at":"2026-11-02T15:28:22.77042Z"},{"id":"CVE-2025-7709","description":"An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.","status":"published","published":"2025-09-08T15:15:38Z","modified":"2026-04-22T18:29:26.059987548Z","updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"openSUSE-SU-2026:10171-1","title":"lemon-3.51.2-1.1 on GA media","description":"These are all security issues fixed in the lemon-3.51.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-03-23T04:54:32.295649Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20513-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate sqlite3 to version 3.51.3:\n\nSecurity issues:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nNon security issue:\n\n- sqlite3 won't build when using --with icu (bsc#1248586).\n\nChangelog:\n\nUpdate to version 3.51.3:\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n\nUpdate to version 3.51.2:\n\n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n\nUpdate to version 3.51.1:\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n\nUpdate to version 3.51.0:\n * New macros in sqlite3.h:\n - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n source code is taken.\n - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n code check-in.\n - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n same as the existing json_each() and json_tree() functions\n except that they return JSONB for the \"value\" column when the\n \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n amalgamation, though they are disabled by default and must be\n activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n - Add the -asdict flag to the eval command to have it set the\n row data as a dict instead of an array.\n - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n - Increase the precision of \".timer\" to microseconds.\n - Enhance the \"box\" and \"column\" formatting modes to deal with\n double-wide characters.\n - The \".imposter\" command provides read-only imposter tables\n that work with VACUUM and do not require the --unsafe-testing\n option.\n - Add the --ifexists option to the CLI command-line option and\n to the .open command.\n - Limit columns widths set by the \".width\" command to 30,000 or\n less, as there is not good reason to have wider columns, but\n supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n - Use fewer CPU cycles to commit a read transaction.\n - Early detection of joins that return no rows due to one or\n more of the tables containing no rows.\n - Avoid evaluation of scalar subqueries if the result of the\n subquery does not change the result of the overall expression.\n - Faster window function queries when using\n \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n existing sqlite3_db_status() API except that it returns 64-bit\n results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n interface.\n * For the built-in printf() and the format() SQL function, omit\n the leading '-' from negative floating point numbers if the '+'\n flag is omitted and the \"#\" flag is present and all displayed\n digits are '0'. Use '%#f' or similar to avoid outputs like\n '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n continue to be 32-bit but creating one's own 64-bit build is\n now as simple as running \"make\".\n * Improved resistance to database corruption caused by an\n application breaking Posix advisory locks using close().\n","status":"published","published":"2026-04-10T18:56:55Z","modified":"2026-04-22T18:26:01.985505Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-7709","title":"CVE-2025-7709 in sqlite3 - Patched by Root","description":"Root has patched CVE-2025-7709 in the sqlite3 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:45:03Z","modified":"2026-11-03T12:15:08.011116864Z","updated_at":"2026-11-03T12:31:35.467775Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2025-7709","title":"CVE-2025-7709 in rootio-sqlite3 - Patched by Root","description":"Root has patched CVE-2025-7709 in the rootio-sqlite3 package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-01-20T13:52:06Z","modified":"2026-09-18T08:00:05.105702547Z","updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"SUSE-SU-2026:0395-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- Update to v3.51.2:\n- CVE-2025-7709: Fixed an integer overflow in the FTS5 extension. (bsc#1254670)\n","status":"published","published":"2026-02-06T08:02:10Z","modified":"2026-02-07T14:00:14.480464Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0432-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- Update to v3.51.2:\n- CVE-2025-7709: Fixed an integer overflow in the FTS5 extension. (bsc#1254670)\n","status":"published","published":"2026-02-11T09:12:16Z","modified":"2026-03-23T04:52:13.798484Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0955-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate to 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n","status":"published","published":"2026-03-23T02:34:14Z","modified":"2026-03-24T08:45:06.504005Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1065-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate sqlite3 to 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n","status":"published","published":"2026-03-26T10:38:26Z","modified":"2026-03-27T08:48:27.822241Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20771-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate to sqlite3 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\nUpdate to version 3.51.3:\n\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n  \nUpdate to version 3.51.2:\n \n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n  \nUpdate to version 3.51.1:\n\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n  \nUpdate to version 3.51.0:\n * New macros in sqlite3.h:\n - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n source code is taken.\n - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n code check-in.\n - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n same as the existing json_each() and json_tree() functions\n except that they return JSONB for the \"value\" column when the\n \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n amalgamation, though they are disabled by default and must be\n activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n - Add the -asdict flag to the eval command to have it set the\n row data as a dict instead of an array.\n - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n - Increase the precision of \".timer\" to microseconds.\n - Enhance the \"box\" and \"column\" formatting modes to deal with\n double-wide characters.\n - The \".imposter\" command provides read-only imposter tables\n that work with VACUUM and do not require the --unsafe-testing\n option.\n - Add the --ifexists option to the CLI command-line option and\n to the .open command.\n - Limit columns widths set by the \".width\" command to 30,000 or\n less, as there is not good reason to have wider columns, but\n supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n - Use fewer CPU cycles to commit a read transaction.\n - Early detection of joins that return no rows due to one or\n more of the tables containing no rows.\n - Avoid evaluation of scalar subqueries if the result of the\n subquery does not change the result of the overall expression.\n - Faster window function queries when using\n \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n existing sqlite3_db_status() API except that it returns 64-bit\n results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n interface.\n * For the built-in printf() and the format() SQL function, omit\n the leading '-' from negative floating point numbers if the '+'\n flag is omitted and the \"#\" flag is present and all displayed\n digits are '0'. Use '%#f' or similar to avoid outputs like\n '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n continue to be 32-bit but creating one's own 64-bit build is\n now as simple as running \"make\".\n","status":"published","published":"2026-03-23T09:46:42Z","modified":"2026-03-25T17:23:47.164397Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20794-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate to version 3.51.3:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nChangelog:\n\nUpdate to version 3.51.3:\n  \n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n  \nUpdate to version 3.51.2:\n \n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n  \nUpdate to version 3.51.1:\n \n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n  \nUpdate to version 3.51.0:\n \n * New macros in sqlite3.h:\n   - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n     source code is taken.\n   - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n     code check-in.\n   - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n   same as the existing json_each() and json_tree() functions\n   except that they return JSONB for the \"value\" column when the\n   \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n   amalgamation, though they are disabled by default and must be\n   activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n   and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n   - Add the -asdict flag to the eval command to have it set the\n     row data as a dict instead of an array.\n   - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n   - Increase the precision of \".timer\" to microseconds.\n   - Enhance the \"box\" and \"column\" formatting modes to deal with\n     double-wide characters.\n   - The \".imposter\" command provides read-only imposter tables\n     that work with VACUUM and do not require the --unsafe-testing\n     option.\n   - Add the --ifexists option to the CLI command-line option and\n     to the .open command.\n   - Limit columns widths set by the \".width\" command to 30,000 or\n     less, as there is not good reason to have wider columns, but\n     supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n   - Use fewer CPU cycles to commit a read transaction.\n   - Early detection of joins that return no rows due to one or\n     more of the tables containing no rows.\n   - Avoid evaluation of scalar subqueries if the result of the\n     subquery does not change the result of the overall expression.\n   - Faster window function queries when using\n     \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n   SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n   existing sqlite3_db_status() API except that it returns 64-bit\n   results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n   sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n   interface.\n * For the built-in printf() and the format() SQL function, omit\n   the leading '-' from negative floating point numbers if the '+'\n   flag is omitted and the \"#\" flag is present and all displayed\n   digits are '0'. Use '%#f' or similar to avoid outputs like\n   '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n   continue to be 32-bit but creating one's own 64-bit build is\n   now as simple as running \"make\".\n","status":"published","published":"2026-03-19T12:20:26Z","modified":"2026-03-25T17:23:50.73513Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21095-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate sqlite3 to version 3.51.3:\n\nSecurity issues:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nNon security issue:\n\n- sqlite3 won't build when using --with icu (bsc#1248586).\n\nChangelog:\n\nUpdate to version 3.51.3:\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n\nUpdate to version 3.51.2:\n\n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n\nUpdate to version 3.51.1:\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n\nUpdate to version 3.51.0:\n * New macros in sqlite3.h:\n - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n source code is taken.\n - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n code check-in.\n - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n same as the existing json_each() and json_tree() functions\n except that they return JSONB for the \"value\" column when the\n \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n amalgamation, though they are disabled by default and must be\n activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n - Add the -asdict flag to the eval command to have it set the\n row data as a dict instead of an array.\n - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n - Increase the precision of \".timer\" to microseconds.\n - Enhance the \"box\" and \"column\" formatting modes to deal with\n double-wide characters.\n - The \".imposter\" command provides read-only imposter tables\n that work with VACUUM and do not require the --unsafe-testing\n option.\n - Add the --ifexists option to the CLI command-line option and\n to the .open command.\n - Limit columns widths set by the \".width\" command to 30,000 or\n less, as there is not good reason to have wider columns, but\n supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n - Use fewer CPU cycles to commit a read transaction.\n - Early detection of joins that return no rows due to one or\n more of the tables containing no rows.\n - Avoid evaluation of scalar subqueries if the result of the\n subquery does not change the result of the overall expression.\n - Faster window function queries when using\n \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n existing sqlite3_db_status() API except that it returns 64-bit\n results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n interface.\n * For the built-in printf() and the format() SQL function, omit\n the leading '-' from negative floating point numbers if the '+'\n flag is omitted and the \"#\" flag is present and all displayed\n digits are '0'. Use '%#f' or similar to avoid outputs like\n '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n continue to be 32-bit but creating one's own 64-bit build is\n now as simple as running \"make\".\n * Improved resistance to database corruption caused by an\n application breaking Posix advisory locks using close().\n","status":"published","published":"2026-04-10T18:50:16Z","modified":"2026-04-17T18:23:56.485886Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21173-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\nUpdate sqlite3 to version 3.51.3:\n\nSecurity issues:\n\n- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).\n- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).\n\nNon security issue:\n\n- sqlite3 won't build when using --with icu (bsc#1248586).\n\nChangelog:\n\nUpdate to version 3.51.3:\n * Fix the WAL-reset database corruption bug:\n   https://sqlite.org/wal.html#walresetbug\n * Other minor bug fixes.\n\nUpdate to version 3.51.2:\n\n * Fix an obscure deadlock in the new broken-posix-lock detection\n   logic.\n * Fix multiple problems in the EXISTS-to-JOIN optimization.\n\nUpdate to version 3.51.1:\n * Fix incorrect results from nested EXISTS queries caused by the\n   optimization in item 6b in the 3.51.0 release.\n * Fix a latent bug in fts5vocab virtual table, exposed by new\n   optimizations in the 3.51.0 release\n\nUpdate to version 3.51.0:\n * New macros in sqlite3.h:\n - SQLITE_SCM_BRANCH -\u003e the name of the branch from which the\n source code is taken.\n - SQLITE_SCM_TAGS -\u003e space-separated list of tags on the source\n code check-in.\n - SQLITE_SCM_DATETIME -\u003e ISO-8601 date and time of the source\n * Two new JSON functions, jsonb_each() and jsonb_tree() work the\n same as the existing json_each() and json_tree() functions\n except that they return JSONB for the \"value\" column when the\n \"type\" is 'array' or 'object'.\n * The carray and percentile extensions are now built into the\n amalgamation, though they are disabled by default and must be\n activated at compile-time using the -DSQLITE_ENABLE_CARRAY\n and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.\n * Enhancements to TCL Interface:\n - Add the -asdict flag to the eval command to have it set the\n row data as a dict instead of an array.\n - User-defined functions may now break to return an SQL NULL.\n * CLI enhancements:\n - Increase the precision of \".timer\" to microseconds.\n - Enhance the \"box\" and \"column\" formatting modes to deal with\n double-wide characters.\n - The \".imposter\" command provides read-only imposter tables\n that work with VACUUM and do not require the --unsafe-testing\n option.\n - Add the --ifexists option to the CLI command-line option and\n to the .open command.\n - Limit columns widths set by the \".width\" command to 30,000 or\n less, as there is not good reason to have wider columns, but\n supporting wider columns provides opportunity to malefactors.\n * Performance enhancements:\n - Use fewer CPU cycles to commit a read transaction.\n - Early detection of joins that return no rows due to one or\n more of the tables containing no rows.\n - Avoid evaluation of scalar subqueries if the result of the\n subquery does not change the result of the overall expression.\n - Faster window function queries when using\n \"BETWEEN :x FOLLOWING AND :y FOLLOWING\" with a large :y.\n * Add the PRAGMA wal_checkpoint=NOOP; command and the\n SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().\n * Add the sqlite3_set_errmsg() API for use by extensions.\n * Add the sqlite3_db_status64() API, which works just like the\n existing sqlite3_db_status() API except that it returns 64-bit\n results.\n * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the\n sqlite3_db_status() and sqlite3_db_status64() interfaces.\n * In the session extension add the sqlite3changeset_apply_v3()\n interface.\n * For the built-in printf() and the format() SQL function, omit\n the leading '-' from negative floating point numbers if the '+'\n flag is omitted and the \"#\" flag is present and all displayed\n digits are '0'. Use '%#f' or similar to avoid outputs like\n '-0.00' and instead show just '0.00'.\n * Improved error messages generated by FTS5.\n * Enforce STRICT typing on computed columns.\n * Improved support for VxWorks\n * JavaScript/WASM now supports 64-bit WASM. The canonical builds\n continue to be 32-bit but creating one's own 64-bit build is\n now as simple as running \"make\".\n * Improved resistance to database corruption caused by an\n application breaking Posix advisory locks using close().\n","status":"published","published":"2026-04-10T18:50:16Z","modified":"2026-04-22T18:25:39.841576Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-7751-1","title":"sqlite3 vulnerability","description":"It was discovered that the FTS5 SQLite extension incorrectly calculated\ncertain array lengths. An attacker could use this issue to cause SQLite to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.","status":"published","published":"2025-09-15T14:45:19Z","modified":"2026-04-22T11:02:23.739915Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}