This issue arises when the number of aggregate terms in a query exceeds the number of available columns, causing an integer truncation error that leads to memory corruption. The resulting overwrite can crash the application or, if an attacker can influence the memory layout, lead to arbitrary code execution. The weakness is classified as CWE-197.

SQLite databases reported for versions prior to 3.50.2 are affected. The CVE specifically lists SQLite SQLite as the vendor, and the affected version range is all releases before 3.50.2.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of 1% suggests that exploitation is not yet widespread but possible. The vulnerability is not listed in CISA KEV. Attackers could possibly exploit the flaw by submitting crafted SQL statements that trigger the aggregate over‑allocation; this is inferred from the description and typical usage of SQLite. Successful exploitation would require ability to run SQL against the vulnerable SQLite instance, which may be local or exposed over a network depending on the application design.