CVE-2025-6965 — Vulnerability in SQLitePCLRaw.lib.e_sqlite3 — CVE...
HIGH
SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite
Published July 15, 2025Updated June 18, 2026Source: osv
Summary
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
Advisory Timeline
- First published July 15, 2025 (454 days ago).
- Last revised June 18, 2026 — 338 days after initial publication.
Affected Packages (3)
Affects 1 ecosystem: nuget (3).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| SQLitePCLRaw.lib.e_sqlite3 | nuget | 2.0.0, 2.0.0-pre20190620134904, 2.0.0-pre20190621100518, 2.0.0-pre20190625090255 (+50 more) | Range-based data available |
| SQLitePCLRaw.lib.e_sqlite3.ios | nuget | 2.0.0, 2.0.0-pre20190620134904, 2.0.0-pre20190621100518, 2.0.0-pre20190625090255 (+48 more) | Range-based data available |
| SQLitePCLRaw.lib.e_sqlite3.android | nuget | 1.0.0, 1.0.0-pre20160901085507, 1.0.0-pre20160912104037, 1.0.1 (+71 more) | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-197
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/google/security-research/security/advisories/GHSA-qj7j-3jp8-8ccvWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-6965ADVISORY
- https://github.com/github/advisory-database/pull/7675WEB
- https://cert-portal.siemens.com/productcert/html/ssa-225816.htmlWEB
- https://cert-portal.siemens.com/productcert/html/ssa-485750.htmlWEB
- https://github.com/ericsink/SQLitePCL.rawPACKAGE
- https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8WEB
- https://seclists.org/fulldisclosure/2025/Sep/49WEB
- https://seclists.org/fulldisclosure/2025/Sep/53WEB
- https://seclists.org/fulldisclosure/2025/Sep/56WEB
- https://seclists.org/fulldisclosure/2025/Sep/57WEB
- https://seclists.org/fulldisclosure/2025/Sep/58WEB
- https://www.openwall.com/lists/oss-security/2025/09/06/1WEB
Frequently Asked Questions
- What is CVE-2025-6965?
- SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2025-6965?
- CVE-2025-6965 affects SQLitePCLRaw.lib.e_sqlite3, SQLitePCLRaw.lib.e_sqlite3.ios and SQLitePCLRaw.lib.e_sqlite3.android. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-6965 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-2m69-gcr7-jv3q
BIT-sqlite-2025-6965
Related CVEs
- CVE-2026-106112HIGH
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
- CVE-2026-106115HIGH
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies