{"id":"CVE-2022-35737","title":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","summary":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-129"],"vendor":"sqlite","product":"sqlite","affected":["sqlite >= 1.0.12, < 3.39.2","ontap_select_deploy_administration_utility","universal_forwarder >= 8.2.0, < 8.2.12","universal_forwarder >= 9.0.0, < 9.0.6","universal_forwarder = 9.1.0"],"patched":["sqlite 3.39.2","universal_forwarder 9.0.6"],"published":"2022-08-03","updated":"2026-10-14","sourceUpdated":"2026-10-14T18:17:01.163","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-35737","references":[{"url":"https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/","label":"cve@mitre.org"},{"url":"https://kb.cert.org/vuls/id/720344","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202210-40","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20220915-0009/","label":"cve@mitre.org"},{"url":"https://sqlite.org/releaselog/3_39_2.html","label":"cve@mitre.org"},{"url":"https://www.sqlite.org/cves.html","label":"cve@mitre.org"},{"url":"https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://kb.cert.org/vuls/id/720344","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202210-40","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220915-0009/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://sqlite.org/releaselog/3_39_2.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.sqlite.org/cves.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","exploit-available"],"epss":0.22774,"epssPercentile":0.97704,"exploits":{"github":2,"githubRepos":["https://github.com/gmh5225/CVE-2022-35737","https://github.com/rvermeulen/codeql-cve-2022-35737"],"checkedAt":"2026-10-14T18:48:13.825Z"},"exploitAvailable":true,"ingestedAt":"2026-10-14T18:47:39.268Z","slug":"CVE-2022-35737","body":"## Overview\n\nSQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.\n\n## Affected\n\n- `sqlite >= 1.0.12, < 3.39.2`\n- `ontap_select_deploy_administration_utility`\n- `universal_forwarder >= 8.2.0, < 8.2.12`\n- `universal_forwarder >= 9.0.0, < 9.0.6`\n- `universal_forwarder = 9.1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `sqlite 3.39.2`\n- `universal_forwarder 9.0.6`","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":41.3,"likelihood":4.6,"exploitation":12,"ransomware":0},"changes":[]}