SQLite < 3.45.0 — RCE
A flaw in SQLite's JSON processing can crash or compromise applications that process untrusted JSON data through SQLite's built-in JSON functions.
An attacker who can cause an application to process attacker-controlled JSON through SQLite's JSON functions can trigger a heap overflow. Depending on the application, this may lead to a crash (denial of service) or potentially arbitrary code execution in the application's context.
SQLite is a lightweight embedded database library used by thousands of applications including Chrome, Python, and many enterprise tools. It is rarely installed as a standalone service — instead it is bundled inside other applications. A heap buffer overflow in SQLite's JSONB handler can be triggered when processing specially crafted JSON data through SQLite's json_* functions.
Probably yes if any of these apply:
Affected OS versions
A web application that stores and queries user-supplied JSON data in a SQLite database processes a malformed JSON payload. The heap overflow crashes the application, causing a service outage. Depending on the application architecture, a skilled attacker may be able to exploit the overflow for code execution.
Manual remediation steps
⏱ 15–30 minutes per applicationFind All SQLite Installations
# Search for SQLite DLL files
Get-ChildItem -Path C:\, D:\ -Filter 'sqlite3.dll' -Recurse -ErrorAction SilentlyContinue |
ForEach-Object {
$v = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($_.FullName)
[PSCustomObject]@{
Path = $_.FullName
Version = $v.FileVersion
Product = $v.ProductName
}
} | Format-Table -AutoSize
# Check Python bundled SQLite
python -c 'import sqlite3; print("Python SQLite:", sqlite3.sqlite_version)' 2>$null
Remediation — Update the Parent Application
SQLite cannot be updated independently. Update the application that bundles it:
| Application | How to Update | |---|---| | Google Chrome | Update Chrome | | Python | Update Python | | Firefox | Update Firefox | | Custom app | Recompile with SQLite 3.45.0+ |
Verification
python -c 'import sqlite3; print(sqlite3.sqlite_version)'
# Must show 3.45.0 or later
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References
Related vulnerabilities
SQL Server Cumulative Updates Are Not Delivered via Windows Update
Microsoft SQL Server
HIGH7.5MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability (CVE-2025-14847)
MongoDB MongoDB and MongoDB Server
CVE-2025-14847
HIGH8.8KB4532095: Windows Server Security Update (February 2020)
Microsoft SQL Server
CVE-2020-0618