CVE-2025-6965: sqlite3 vulnerabilities
Affects sqlite3Source GCVE Database
Mentioned vulnerabilities
Public exploit available (Exploit-DB) · fixed in 3.8.2-1ubuntu2.2+esm5 : patch sqlite3 as a priority.
Data as of 27 Oct 2026, 06:42 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- Patch
- Available – fixed in 3.8.2-1ubuntu2.2+esm5, 3.11.0-1ubuntu1.5+esm3, 3.22.0-1ubuntu0.7+esm2 +1
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 29 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: evidence found.
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE published
on cve.org
, t = 0
First Exploit-DB entry (opens in a new tab)
SQLite 3.50.1 - Heap Overflow
, 253 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu Pro 20.04 LTSsqlite3pkg:deb/ubuntu/sqlite3?arch=source&distro=esm-infra/focalOther threats | Affected
| Fixed in
|
Ubuntu Pro 18.04 LTSsqlite3pkg:deb/ubuntu/sqlite3?arch=source&distro=esm-infra/bionicOther threats | Affected
| Fixed in
|
Ubuntu Pro 16.04 LTSsqlite3pkg:deb/ubuntu/sqlite3?arch=source&distro=esm-infra/xenialOther threats | Affected
| Fixed in
|
Ubuntu Pro 14.04 LTSsqlite3pkg:deb/ubuntu/sqlite3?arch=source&distro=esm-infra-legacy/trustyOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
It was discovered that SQLite incorrectly handled aggregate terms. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-6965) It was discovered that SQLite incorrectly handled certain argument values to sqlite3_db_config(). An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This update fixes the issue in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. This issue was previously fixed in Ubuntu 20.04 LTS via USN-7528-1. (CVE-2025-29088)