Integer Overflow Vulnerability in SQLite Versions 3.39.2 to 3.41.1
CVE-2025-7458

6.9MEDIUM

Key Information:

Vendor

Sqlite

Status
Vendor
CVE Published:
29 July 2025

What is CVE-2025-7458?

An integer overflow vulnerability exists in the sqlite3KeyInfoFromExprList function of SQLite, affecting versions from 3.39.2 to 3.41.1. This flaw allows attackers, who can execute arbitrary SQL statements, to formulate SELECT queries that utilize a large number of expressions in the ORDER BY clause. Exploiting this vulnerability can lead to Denial of Service conditions or the exposure of sensitive data stored in the process memory.

Affected Version(s)

SQLite 3.39.2 < 3.41.2

References

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

.
CVE-2025-7458 : Integer Overflow Vulnerability in SQLite Versions 3.39.2 to 3.41.1