CVE-2025-6965

HIGH

SQLite < 3.50.2 - Memory Corruption via Aggregate Terms Overflow

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-6965. PoCs published by Mohammed Idrees Banyamer.

AI-analyzed exploit summary This exploit demonstrates a heap overflow in SQLite (winsqlite3.dll) via excessive aggregate functions, targeting Windows Server Active Directory services. It creates a malicious database, deploys it to the AD cache directory, and triggers the vulnerability by executing a crafted SQL query.

Description

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

Exploits (1)

exploitdb WORKING POC

by Mohammed Idrees Banyamer · pythonlocalwindows

https://www.exploit-db.com/exploits/52499

View Code ZIP pw:eip

This exploit demonstrates a heap overflow in SQLite (winsqlite3.dll) via excessive aggregate functions, targeting Windows Server Active Directory services. It creates a malicious database, deploys it to the AD cache directory, and triggers the vulnerability by executing a crafted SQL query.

Classification

Working Poc 95%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: SQLite < 3.50.2 (winsqlite3.dll)

No auth needed

Prerequisites: Unpatched Windows Server with SQLite < 3.50.2 · Access to deploy files to AD cache directory

MITRE ATT&CK