CVE-2025-7709

An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
GoogleCNA
---
---
CISA-ADPADP
---
---
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
Debian logo
Debian Releases
Debian Product
Codename
sqlite3
bullseye
3.34.1-3
not-affected
trixie
no-dsa
bookworm
no-dsa
bullseye (security)
3.34.1-3+deb11u1
fixed
forky
3.46.1-8
fixed
sid
3.46.1-8
fixed
Common Weakness Enumeration
References
https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g
http://www.openwall.com/lists/oss-security/2025/09/06/2
http://www.openwall.com/lists/oss-security/2025/11/18/10