https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-70873.htmlhttps://patchthecve.com/cve/CVE-2025-70873.htmlThu, 15 Oct 2026 02:18:16 +0000HIGH 7.5: An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.https://patchthecve.com/cve/CVE-2025-7458.htmlhttps://patchthecve.com/cve/CVE-2025-7458.htmlWed, 17 Jun 2026 10:04:59 +0000CRITICAL 9.1: An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a larhttps://patchthecve.com/cve/CVE-2025-6965.htmlhttps://patchthecve.com/cve/CVE-2025-6965.htmlThu, 15 Oct 2026 02:18:15 +0000HIGH 7.7: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.https://patchthecve.com/cve/CVE-2025-3277.htmlhttps://patchthecve.com/cve/CVE-2025-3277.htmlThu, 15 Oct 2026 02:18:04 +0000CRITICAL 9.8: An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be trihttps://patchthecve.com/cve/CVE-2025-29088.htmlhttps://patchthecve.com/cve/CVE-2025-29088.htmlThu, 15 Oct 2026 02:17:47 +0000MEDIUM 5.6: In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.https://patchthecve.com/cve/CVE-2025-29087.htmlhttps://patchthecve.com/cve/CVE-2025-29087.htmlThu, 15 Oct 2026 02:17:47 +0000LOW 3.2: In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of t