SQLite < 3.45.0 — RCE
A flaw in SQLite's JSON processing can crash or compromise applications that process untrusted JSON data through SQLite's built-in JSON functions.
An attacker who can cause an application to process attacker-controlled JSON through SQLite's JSON functions can trigger a heap overflow. Depending on the application, this may lead to a crash (denial of service) or potentially arbitrary code execution in the application's context.
SQLite is a lightweight embedded database library used by thousands of applications including Chrome, Python, and many enterprise tools. It is rarely installed as a standalone service — instead it is bundled inside other applications. A heap buffer overflow in SQLite's JSONB handler can be triggered when processing specially crafted JSON data through SQLite's json_* functions.
Probably yes if any of these apply:
Affected OS versions
A web application that stores and queries user-supplied JSON data in a SQLite database processes a malformed JSON payload. The heap overflow crashes the application, causing a service outage. Depending on the application architecture, a skilled attacker may be able to exploit the overflow for code execution.
Manual remediation steps
⏱ 15–30 minutes per applicationFind All SQLite Installations
# Search for SQLite DLL files
Get-ChildItem -Path C:\, D:\ -Filter 'sqlite3.dll' -Recurse -ErrorAction SilentlyContinue |
ForEach-Object {
$v = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($_.FullName)
[PSCustomObject]@{
Path = $_.FullName
Version = $v.FileVersion
Product = $v.ProductName
}
} | Format-Table -AutoSize
# Check Python bundled SQLite
python -c 'import sqlite3; print("Python SQLite:", sqlite3.sqlite_version)' 2>$null
Remediation — Update the Parent Application
SQLite cannot be updated independently. Update the application that bundles it:
| Application | How to Update | |---|---| | Google Chrome | Update Chrome | | Python | Update Python | | Firefox | Update Firefox | | Custom app | Recompile with SQLite 3.45.0+ |
Verification
python -c 'import sqlite3; print(sqlite3.sqlite_version)'
# Must show 3.45.0 or later
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References