Vulnerabilities in pkg:nuget/SQLitePCLRaw.lib.e_sqlite3

PACKAGE
Advisory Identifier: GHSA-2m69-gcr7-jv3q
Share
Advisory Summary

CVE-2025-6965 is a HIGH (CVSS 9.8) sqlitepclraw.lib.e_sqlite3 has a vulnerable dependency vulnerability (CWE-197: Numeric Truncation Error) affecting SQLitePCLRaw.lib.e sqlite3 libraries in the NuGet ecosystem. The issue involves sqlitepclraw.lib.e_sqlite3 has a vulnerable dependency on sqlite. Remediation is available in the latest vendor maintenance releases.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:nuget/SQLitePCLRaw.lib.e_sqlite3

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:nuget/SQLitePCLRaw.lib.e_sqlite3. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-2m69-gcr7-jv3q CVE-2025-6965 HIGH SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite

CVE-2025-6965 at a Glance

CVE Identifier CVE-2025-6965
GHSA Identifier GHSA-2m69-gcr7-jv3q
Severity HIGH
CVSS v3.1 Base Score 9.8
CWE Classification CWE-197: Numeric Truncation Error
Affected Product SQLitePCLRaw.lib.e sqlite3
Package Ecosystem NuGet
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2025-6965

To remediate this vulnerability, upgrade all affected SQLitePCLRaw.lib.e sqlite3 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

SQLitePCLRaw.lib.e_sqlite3 fixed: Latest secure release 
Upgrade SQLitePCLRaw.lib.e_sqlite3 to Latest secure release
SQLitePCLRaw.lib.e_sqlite3.android fixed: Latest secure release 
Upgrade SQLitePCLRaw.lib.e_sqlite3.android to Latest secure release
SQLitePCLRaw.lib.e_sqlite3.ios fixed: Latest secure release 
Upgrade SQLitePCLRaw.lib.e_sqlite3.ios to Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for SQLitePCLRaw.lib.e_sqlite3

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-6965, inspect your project dependencies for SQLitePCLRaw.lib.e sqlite3:

inspect dependencies for SQLitePCLRaw.lib.e_sqlite3

Analyze the terminal output to locate any version of SQLitePCLRaw.lib.e sqlite3 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-197: Numeric Truncation Error, where truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. In SQLitePCLRaw.lib.e sqlite3, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

CVE-2025-6965 Affected SQLitePCLRaw.lib.e sqlite3 Versions

3 component(s)
Product / Package Ecosystem Affected Versions Fixed Version
SQLitePCLRaw.lib.e_sqlite3
nuget/SQLitePCLRaw.lib.e_sqlite3
NuGet
≤ 2.1.11
SQLitePCLRaw.lib.e_sqlite3.android
nuget/SQLitePCLRaw.lib.e_sqlite3.android
NuGet
≤ 2.1.11
SQLitePCLRaw.lib.e_sqlite3.ios
nuget/SQLitePCLRaw.lib.e_sqlite3.ios
NuGet
≤ 2.1.11

References

GitHub Advisory / Wiki ADVISORY
https://github.com/google/security-research/security/advisories/GHSA-qj7j-3jp8-8ccv
NVD — CVE-2025-6965 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6965
SQLitePCLRaw.lib.e sqlite3 Source Repository REPOSITORY
https://github.com/github/advisory-database/pull/7675
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-225816.html
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-485750.html
SQLitePCLRaw.lib.e sqlite3 Source Repository REPOSITORY
https://github.com/ericsink/SQLitePCL.raw
www.sqlite.org/src/info/5508b56fd2... WEB
https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8
seclists.org/fulldisclosure/2025... WEB
http://seclists.org/fulldisclosure/2025/Sep/49
seclists.org/fulldisclosure/2025... WEB
http://seclists.org/fulldisclosure/2025/Sep/53
seclists.org/fulldisclosure/2025... WEB
http://seclists.org/fulldisclosure/2025/Sep/56
seclists.org/fulldisclosure/2025... WEB
http://seclists.org/fulldisclosure/2025/Sep/57
seclists.org/fulldisclosure/2025... WEB
http://seclists.org/fulldisclosure/2025/Sep/58
SQLitePCLRaw.lib.e sqlite3 Security Information SECURITY
http://www.openwall.com/lists/oss-security/2025/09/06/1

Frequently Asked Questions

What is CVE-2025-6965?
CVE-2025-6965 is a security vulnerability in SQLitePCLRaw.lib.e sqlite3 involving SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite under CWE-197: Numeric Truncation Error.
Which SQLitePCLRaw.lib.e sqlite3 versions are affected?
Affected versions include releases prior to current release patches across affected packages: SQLitePCLRaw.lib.e_sqlite3, SQLitePCLRaw.lib.e_sqlite3.android, SQLitePCLRaw.lib.e_sqlite3.ios.
What version fixes CVE-2025-6965?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is SQLitePCLRaw.lib.e_sqlite3 affected?
Yes, SQLitePCLRaw.lib.e_sqlite3 is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
Is SQLitePCLRaw.lib.e_sqlite3.android affected?
Yes, SQLitePCLRaw.lib.e_sqlite3.android is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of CVE-2025-6965?
CVE-2025-6965 has a CVSS v3.1 base score of 9.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2025-6965?
CVE-2025-6965 is classified under CWE-197: Numeric Truncation Error (Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.).
How can I check NuGet dependencies for CVE-2025-6965?
Run the dependency tree command: 'inspect dependencies for SQLitePCLRaw.lib.e_sqlite3'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2m69-gcr7-jv3q",
  "modified" : "2026-06-18T13:01:42Z",
  "published" : "2025-07-15T15:31:00Z",
  "aliases" : [ "CVE-2025-6965" ],
  "summary" : "SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite",
  "details" : "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "SQLitePCLRaw.lib.e_sqlite3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "2.1.11"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "SQLitePCLRaw.lib.e_sqlite3.android"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "2.1.11"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "SQLitePCLRaw.lib.e_sqlite3.ios"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "2.1.11"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/google/security-research/security/advisories/GHSA-qj7j-3jp8-8ccv"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-6965"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/github/advisory-database/pull/7675"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-225816.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ericsink/SQLitePCL.raw"
  }, {
    "type" : "WEB",
    "url" : "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2025/Sep/49"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2025/Sep/53"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2025/Sep/56"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2025/Sep/57"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2025/Sep/58"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2025/09/06/1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-197" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-18T13:01:42Z",
    "nvd_published_at" : "2025-07-15T14:15:31Z"
  }
}