CVE-2025-7709 MEDIUM

CVE-2025-7709: Out Of Bounds write in FTS5 Extension in SQLite

Vendor Sqlite
Product FTS5
Weakness CWE-190
Published September 8, 2025
Last update November 18, 2025

CVSS base score

6.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

What the vulnerability does

01Description

An integer overflow exists in the FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.

Key dates

02Disclosure timeline

September 8, 2025 CVE published
November 18, 2025 Record updated