← Vulnerability feed

Vulnerability record · CVE-2022-35737 · published 3 August 2022

CVE-2022-35737: Sqlite vulnerability

Sqlite · Sqlite

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

7.5 CVSS 3.1 High EPSS 23% · top 2.3% CWE-129 · CWE-129
7.5CVSS 3.1 base score
23%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
12References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/ ExploitThird Party Advisory
https://kb.cert.org/vuls/id/720344 Broken LinkThird Party AdvisoryUS Government Resource
https://security.gentoo.org/glsa/202210-40 Third Party Advisory
https://security.netapp.com/advisory/ntap-20220915-0009/ Third Party Advisory
https://sqlite.org/releaselog/3_39_2.html Release NotesVendor Advisory
https://www.sqlite.org/cves.html Vendor Advisory
https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/ ExploitThird Party Advisory
https://kb.cert.org/vuls/id/720344 Broken LinkThird Party AdvisoryUS Government Resource
https://security.gentoo.org/glsa/202210-40 Third Party Advisory
https://security.netapp.com/advisory/ntap-20220915-0009/ Third Party Advisory
https://sqlite.org/releaselog/3_39_2.html Release NotesVendor Advisory
https://www.sqlite.org/cves.html Vendor Advisory

Track CVE-2022-35737 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.6CVE-2020-15999FreeType heap buffer overflow in Chrome via crafted HTML pageFreeType contains a heap buffer overflow reachable through a crafted HTML page in Google Chrome prior to 86.0.4240.111. The flaw is an out-of-bounds …KEVEPSS 44%analysed7.8CVE-2023-4911GNU C Library ld.so GLIBC_TUNABLES heap buffer overflowThe GNU C Library dynamic loader ld.so mishandles the GLIBC_TUNABLES environment variable, causing a heap-based buffer overflow and out-of-bounds wri…KEVEPSS 81%analysed7.8CVE-2021-3156Sudo off-by-one heap overflow allows root privilege escalationSudo before 1.9.5p2 contains an off-by-one error leading to a heap-based buffer overflow. Triggering it via 'sudoedit -s' with a command-line argumen…KEVEPSS 100%analysed7.0CVE-2016-5195Linux Kernel Dirty COW Race Condition Privilege EscalationA race condition in the Linux kernel's mm/gup.c mishandles copy-on-write, letting a local user write to read-only memory mappings. This breaks the re…KEVEPSS 84%analysed10.0CVE-2015-5895Sqlite vulnerabilityMultiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.EPSS 9.2%9.8CVE-2024-21990Netapp ontap select deploy administration utility hard-coded password vulnerabilityONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to vi…EPSS 0.32%9.8CVE-2023-37920Certifi insufficient verification of data authenticity vulnerabilityCertifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts…EPSS 0.57%9.8CVE-2022-32221Haxx curl information exposure vulnerabilityWhen doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOP…EPSS 4.4%

Source: NIST National Vulnerability Database (record CVE-2022-35737), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.