SQLite is a ubiquitous embedded database library that, despite a narrow product scope, achieves prominence through its deep integration into countless applications, operating systems, and devices across the landscape. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, creating cascading risk across the full ecosystem of downstream consumers that bundle the library without independent patching cycles. The recurring weakness classes—including NULL-pointer dereferences, integer overflows, use-after-free conditions, and heap-based buffer overflows—reflect the memory-safety demands of a C-based SQL parser and query engine exposed to untrusted database input. Defenders should prioritize SQLite updates as a supply-chain concern, treating patches as broadly applicable across embedded systems, mobile platforms, and server applications that depend on the library; current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sqlite over time
Signals from CVEs in this vendor scope (66 CVEs).
66 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-6965HIGH There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corrupti | Jul 15, 2025 | 7.7 | 80 | NO | YES |
CVE-2019-8457CRITICAL SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. | May 30, 2019 | 9.8 | 50 | NO | NO |
CVE-2015-5895HIGH Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. | Sep 18, 2015 | 10.0 | 39 | NO | YES |
CVE-2026-11824HIGH SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by | Jun 9, 2026 | 7.8 | 35 | NO | NO |
CVE-2026-11822HIGH SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrar | Jun 9, 2026 | 7.8 | 35 | NO | NO |
CVE-2022-35737HIGH SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. | Aug 3, 2022 | 7.5 | 32 | NO | NO |
CVE-2019-19646CRITICAL pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. | Dec 9, 2019 | 9.8 | 32 | NO | NO |
CVE-2020-35527CRITICAL In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause. | Sep 1, 2022 | 9.8 | 31 | NO | NO |
CVE-2019-19317CRITICAL lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have | Dec 5, 2019 | 9.8 | 31 | NO | NO |
CVE-2008-6593HIGH SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid | Apr 3, 2009 | 7.5 | 31 | NO | YES |
Signals from CVEs in this vendor scope (66 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sqlite.
Media articles that mention a CVE ID that affects a product developed by Sqlite — matched by CVE ID, not by vendor name.