CVE-2025-7458: SQLite integer overflow in key info allocation may lead to information disclosure.
An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
Other sources
SQLite integer overflow in key info allocation may lead to information disclosure.
— Microsoft
Affected Software
Remediation
Information
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7458?
CVE-2025-7458 is rated as a high severity vulnerability due to its potential to cause denial of service and disclose sensitive information.
How do I fix CVE-2025-7458?
To fix CVE-2025-7458, upgrade to SQLite version 3.41.2 or later, which includes patches for the integer overflow issue.
What are the risks associated with CVE-2025-7458?
The risks associated with CVE-2025-7458 include potential denial of service attacks and unauthorized access to sensitive information from process memory.
Who is affected by CVE-2025-7458?
CVE-2025-7458 affects all users of SQLite versions 3.39.2 through 3.41.1 who can execute SQL queries.
What type of attack can leverage CVE-2025-7458?
An attacker can leverage CVE-2025-7458 by executing crafted SQL SELECT statements to trigger the integer overflow vulnerability.