SQLite

CVEs (71)

• CVE-2019-19924Dec 24, 2019
  SQLite

  SQLite
  risk 0.01cvss —epss 0.08

  SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.

• CVE-2019-19923Dec 24, 2019
  SQLite

  SQLite
  risk 0.01cvss —epss 0.07

  flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

• CVE-2019-19926Dec 23, 2019
  SQLite

  SQLite
  risk 0.01cvss —epss 0.07

  multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.

• CVE-2019-19880Dec 18, 2019
  SQLite

  SQLite
  risk 0.01cvss —epss 0.07

  exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

• CVE-2019-19603Dec 9, 2019
  SQLite

  SQLite
  risk 0.01cvss —epss 0.08

  SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

• CVE-2018-20505Apr 3, 2019
  SQLite

  SQLite
  risk 0.01cvss —epss 0.07

  SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).

• CVE-2018-20506Apr 3, 2019
  SQLite

  SQLite
  risk 0.01cvss —epss 0.08

  SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by…

• CVE-2018-20346Dec 21, 2018
  SQLite

  SQLite
  risk 0.01cvss —epss 0.10

  SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run…

• CVE-2025-7458Jul 29, 2025
  SQLite

  SQLite
  risk 0.00cvss —epss 0.00

  An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT…

• CVE-2025-3277Apr 14, 2025
  SQLite

  SQLite
  risk 0.00cvss —epss 0.01

  An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow…

• CVE-2025-29088Apr 10, 2025
  SQLite

  SQLite
  risk 0.00cvss —epss 0.00

  In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

• CVE-2025-29087Apr 7, 2025
  SQLite

  SQLite
  risk 0.00cvss —epss 0.00

  In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in…

• CVE-2024-0232Jan 16, 2024
  SQLite

  SQLite
  risk 0.00cvss —epss 0.00

  A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a…

• CVE-2023-7104Dec 25, 2023
  SQLite

  SQLite
  risk 0.00cvss —epss 0.01

  A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is…

• CVE-2021-31239May 9, 2023
  SQLite

  SQLite
  risk 0.00cvss —epss 0.02

  An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.

• CVE-2020-24736Apr 11, 2023
  SQLite

  SQLite
  risk 0.00cvss —epss 0.00

  Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.

• CVE-2022-46908Dec 12, 2022
  SQLite

  SQLite
  risk 0.00cvss —epss 0.00

  SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

• CVE-2020-35527Sep 1, 2022
  SQLite

  SQLite
  risk 0.00cvss —epss 0.01

  In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.

• CVE-2020-35525Sep 1, 2022
  SQLite

  SQLite
  risk 0.00cvss —epss 0.01

  In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.

• CVE-2021-36690Aug 24, 2021
  SQLite

  SQLite
  risk 0.00cvss —epss 0.04

  A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is…