CVE-2025-7709

An integer overflow exists in the  FTS5 https://sqlite.org/fts5.html extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
GoogleCNA
---
---
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
sqlite3
bullseye
3.34.1-3
not-affected
trixie
no-dsa
bookworm
no-dsa
bullseye (security)
3.34.1-3+deb11u1
fixed
forky
vulnerable
sid
vulnerable
Common Weakness Enumeration
References
https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g