SQLite integer overflow in key info allocation may lead to information disclosure. (CVE-2025-7458)
SQLite versions 3.39.2 through 3.41.1 contain an integer overflow vulnerability in the sqlite3KeyInfoFromExprList function. This flaw can be triggered by an attacker able to execute arbitrary SQL statements using a crafted SELECT query with many expressions in the ORDER BY clause. Exploitation may lead to denial of service or disclosure of sensitive information from process memory. A patch is available to address this issue.
AI Analysis
Technical Summary
An integer overflow exists in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1. This vulnerability allows an attacker with the capability to run arbitrary SQL statements to cause a denial of service or leak sensitive memory contents by crafting a SELECT statement with a large number of expressions in the ORDER BY clause. The issue is fixed in version 3.41.2. No known exploits are reported in the wild.
Potential Impact
Successful exploitation can cause denial of service or information disclosure from process memory. The attacker must have the ability to execute arbitrary SQL statements on the vulnerable SQLite instance. There is no indication of remote code execution or privilege escalation beyond this context.
Mitigation Recommendations
A patch is available and should be applied. The vulnerability is fixed in SQLite version 3.41.2. Users should upgrade to this version or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.
SQLite integer overflow in key info allocation may lead to information disclosure. (CVE-2025-7458)
Description
SQLite versions 3.39.2 through 3.41.1 contain an integer overflow vulnerability in the sqlite3KeyInfoFromExprList function. This flaw can be triggered by an attacker able to execute arbitrary SQL statements using a crafted SELECT query with many expressions in the ORDER BY clause. Exploitation may lead to denial of service or disclosure of sensitive information from process memory. A patch is available to address this issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
An integer overflow exists in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1. This vulnerability allows an attacker with the capability to run arbitrary SQL statements to cause a denial of service or leak sensitive memory contents by crafting a SELECT statement with a large number of expressions in the ORDER BY clause. The issue is fixed in version 3.41.2. No known exploits are reported in the wild.
Potential Impact
Successful exploitation can cause denial of service or information disclosure from process memory. The attacker must have the ability to execute arbitrary SQL statements on the vulnerable SQLite instance. There is no indication of remote code execution or privilege escalation beyond this context.
Mitigation Recommendations
A patch is available and should be applied. The vulnerability is fixed in SQLite version 3.41.2. Users should upgrade to this version or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-sqlite-2025-7458
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2025-7458"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Patch Information
Threat ID: 6aa005c1acd9273b49ab5baf
Added to database: 09/08/2026, 12:55:29 UTC
Last enriched: 09/08/2026, 13:16:55 UTC
Last updated: 09/10/2026, 19:36:52 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.