CVE-2025-7709 — Out Of Bounds write in FTS5 Extension in SQLite

CVE-2025-7709

Out Of Bounds write in FTS5 Extension in SQLite PUBLISHED

Description (CNA)

An integer overflow exists in the FTS5 https://sqlite.org/fts5.html extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.

Affected (CNA)

Vendor / product	Versions
SQLite / FTS5	affected 3.49.1 < 3.50

CWE

CWE-190

References

https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/09/06/2
http://www.openwall.com/lists/oss-security/2025/11/18/10