Technical impact
The flaw triggers when the number of aggregate terms in an SQL query exceeds the number of columns available in SQLite, causing an integer truncation that corrupts memory. This corruption can lead to application crashes or data integrity problems. The weakness is classified as CWE‑197.
Affected Systems
All releases of the SQLite engine before version 3.50.2. The vendor list includes SQLite itself, and the CPE data show the library is embedded in a range of products, such as Siemens RuggedCom Crossbow, sIDIS Prime, and Apple operating systems—including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
Risk and Exploitability
The CVSS score of 7.2 indicates high severity, but the EPSS score of less than 1 % indicates a very low likelihood of exploitation. The description does not specify the exact attack vector, but based on the vulnerability it can be inferred that an attacker would need the ability to submit crafted SQL statements that produce an aggregate query exceeding the column count. If the vulnerable SQLite instance is accessible—whether locally or through a remote interface—such a query could trigger the truncation and memory corruption. The flaw is not listed in the CISA KEV catalog, implying no confirmed publicly used exploits as of this analysis.
EUVD
Github GHSA
Ubuntu USN