CyberSecBulletin
CVE-2025-6965NVD status: Modified

SQLite: Numeric Truncation Error

Published Updated By the CyberSecBulletin desk

CVE-2025-6965 is a high-severity numeric truncation error vulnerability in SQLite, with a CVSS 3.1 base score of 7.7 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists version 3.50.2 as the first without the flaw, so updating SQLite to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 73.5% chance of exploitation within 30 days, which is in the top 0.53% of all scored CVEs.

Patch now

Exploitation in the next 30 days is more likely than not, according to EPSS.

What to do

  1. Update SQLite to 3.50.2 or a later version.
  2. Update RUGGEDCOM CROSSBOW Station Access Controller (SAC) to V5.8 or V6.0, whichever matches your release line, or a later version.
  3. Update SIDIS Prime to V4.0.800 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
SQLiteSQLitebefore 3.50.23.50.2
SiemensRUGGEDCOM CROSSBOW Station Access Controller (SAC)before V5.8; before V6.0V5.8, V6.0
SiemensSIDIS Primebefore V4.0.800V4.0.800
AppleiPadOSbefore 26.0.026.0.0
AppleIphone OSbefore 26.0.026.0.0
ApplemacOSbefore 26.0.026.0.0
AppletvOSbefore 26.0.026.0.0
AppleVisionosbefore 26.0.026.0.0
ApplewatchOSbefore 26.0.026.0.0
SiemensRuggedcom Crossbowbefore 5.85.8

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
LowSome restricted data can be read.
Integrity
HighData or code can be modified at will.
Availability
LowPerformance or availability is reduced.

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.07.2HighCNA (google.com)
CVSS 3.17.7HighNVD

Official description

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Numeric Truncation Error

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

How developers prevent this class of flaw

  • Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.

More Numeric Truncation Error vulnerabilities (CWE-197)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in SQLite

All SQLite vulnerabilities

Recent Numeric Truncation Error vulnerabilities

Spotted an error? Tell us.