CVE-2025-6965: Integer Truncation on SQLite

Q: What is the severity of CVE-2025-6965?

CVE-2025-6965 has a medium severity rating due to potential memory corruption risks.

Q: How do I fix CVE-2025-6965?

To fix CVE-2025-6965, upgrade SQLite to version 3.50.2 or higher.

Q: What are the affected versions for CVE-2025-6965?

CVE-2025-6965 affects SQLite versions prior to 3.50.2.

Q: What type of vulnerability is CVE-2025-6965?

CVE-2025-6965 is a vulnerability related to memory corruption due to aggregate term overflow.

Q: Who is impacted by CVE-2025-6965?

Any users or applications utilizing SQLite versions before 3.50.2 are impacted by CVE-2025-6965.

Published Jul 15, 2025

Updated

Accessibility. A logic issue was addressed with improved checks.

Other sources

Accessibility. The issue was addressed by adding additional logic.

— Apple

Admin Framework. A logic issue was addressed with improved checks.

— Apple

Admin Framework. A path handling issue was addressed with improved validation.

— Apple

afclip. The issue was addressed with improved memory handling.

— Apple

AirPort. A permissions issue was addressed with additional restrictions.

— Apple

Credit

Google's Threat Analysis Group, Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Chi Yuan Chang(ZUSO ART), taikosoup, Gary Kwong(Trend Micro Zero Day Initiative), CVE-2025-43226, Christian Kohlschütter, Sergei Glazunov(Google Project Zero), Ivan Fratric(Google Project Zero), Vlad Stolyarov(Google's Threat Analysis Group), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), CVE-2025-6965, Gilad Moav, Yehuda Afek, Anat Bremler-Barr, Amit Klein, Yuhao Hu, Yan Kang, Chenggang Wu, Xiaojie Wei, shandikri(Trend Micro Zero Day Initiative), Google V8 Security Team, Nan Wang@@eternalsakura13, Ziling Chen, HexRabbit@@h3xr4bb1t(DEVCORE Research Team), Ignacio Sanmillan@@ulexec, Clément Lecigne(Google's Threat Analysis Group), Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), Wong Wee Xiang, Himanshu Bharti@@Xpl0itme, Brian Carpenter, Jaydev Ahire, ABC Research s.r.o., Mickey Jin@@patch1t, Noah Gregory (wts.dev), MRHAX, Aditya Rana, Seo Hyun-gyu@@wh1te4ever(Xiaomi), Dora Orak(Xiaomi), Minghao Lin@@Y1nKoc(Xiaomi), XiLong Zhang@@Resery4(Xiaomi), noir@@ROIS, fmyy (@风沐云烟), 风沐云烟@@binary_fmyy, Minghao Lin@@Y1nKoc, Gergely Kalman@@gergely_kalman, an anonymous researcher, 2ourc3 | Salim Largo, Dawuge(Shuffle Team), Anonymous(Trend Micro Zero Day Initiative), Willey Lin, Arsenii Kostromin (0x3c3e), Pyrophoria, Dora Orak, Csaba Fitzl@@theevilbit(Kandji), Kirin@@Pwnrin, Minghao Lin, Jiaxun Zhu, Zhongquan Li@@Guluisacat, Koh M. Nakagawa@@tsunek0h(Kandji), an anonymous researcher(Loadshine Lab), Hikerell(Loadshine Lab), @@zlluny, Wojciech Regula(SecuRing), Yuebin Sun@@yuebinsun2020, Shang-De Jiang(CyCraft Technology), Kazma Ye(CyCraft Technology), Nikolai Skliarenko(Trend Micro Zero Day Initiative), Keith Yeo@@kyeojy(Team Orca of Sea Security), Martin Bajanik(Fingerprint), Ammar Askar, Syarif Muhammad Sajjad, Martti Hütt, Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Ryan Dowd@@_rdowd, Joseph Ravichandran@@0xjprx(MIT CSAIL), Dave G. (supernetworks.org), JZ, Zhongcheng Li(IES Red Team of ByteDance), Michael Reeves@@IntegralPilot, Morris Richman@@morrisinlife, Hikerell (Loadshine Lab), 이동하 (Lee Dong Ha(BoB 14th), wac(Trend Micro Zero Day Initiative), Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), pattern-f@@pattern_F_, Ferdous Saljooki@@malwarezoo(Jamf), Murray Mike, 이동하 (Lee Dong Ha)(SSA Lab), Cristian Dinca (icmd.tech), Apple, Dave G.(supernetworks), Alex Radocea(supernetworks), Taavi Eomäe(Zone Media), Atul R V, Asaf Cohen, CVE-2024-43398, CVE-2024-49761, CVE-2025-6442, Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir, Alexia Wilson(Microsoft), Christine Fossaceca(Microsoft), Wang Yu(Cyberserval), Nikita Sakalouski, Rosyna Keller(Totally Not Malicious Software), Guilherme Rambo(Best Buddy Apps), Yinyi Wu@@_3ndy1(Dawn Security Lab of JD), @@zlluny(Trend Micro Zero Day Initiative), Keisuke Hosoda, Viktor Oreshkin, Philipp Baldauf, Lyutoon@@Lyutoon_, YingQi Shi@@Mas0n, Tom Brzezinski, Abhay Kailasia@@abhay_kailasia(C), KPC(Cisco Talos), Evan Waelde, 정답이 아닌 해답, Richard Hyunho Im@@richeeta, Jiwon Park, Seo Hyun-gyu@@wh1te4ever, Luke Roberts@@rookuu, Big Bear, Mike Cardwell(grepular), Bob Lord, Pawel Wylecial(REDTEAM), Nolan Astrein(Kandji), Mickey Jin@@patch1t(Cisco Talos), Kirin@@Pwnrin(Cisco Talos), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Bilal Siddiqui, Matej Moravec@@MacejkoMoravec, Shantanu Thakur, Jian Lee@@speedyfriend433, Yiğit Can YILMAZ@@yilmazcanyigit, Ye Zhang@@VAR10CK(Baidu Security), Nathaniel Oh@@calysteon, Rodolphe Brunetti@@eisw0lf(Lupus Nova), LFY@@secsys(Fudan University), CVE-2025-40909, CVE-2024-27280, @@RenwaX23, Ye Zhang(Baidu Security), Kirin@@Pwnrin(Computer Science), Cristian Dinca(Computer Science), Romania, Justin Elliot Fu, Pyrophoria(GrapheneOS), an anonymous researcher(GrapheneOS), James J Kalafus, Michel Migdal, ken super

Affected Software

46 affected componentsFixes available

SQLite SQLite<3.50.2

Apple tvOS<18.6

18.6

Apple iOS<18.6

18.6

Apple iPadOS<18.6

18.6

Apple WatchOS<11.6

11.6

Apple visionOS<2.6

2.6

Apple macOS Sequoia<15.6

15.6

Microsoft cbl2 sqlite 3.39.2-4

CVE-2025-6965: Integer Truncation on SQLite

Other sources

Credit

Affected Software

Remediation

Patch Available

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-6965?

How do I fix CVE-2025-6965?

What are the affected versions for CVE-2025-6965?

What type of vulnerability is CVE-2025-6965?

Who is impacted by CVE-2025-6965?

Company

Resources

Contact