CVE-2020-13434: SQLite memory corruption via aggregate term overflow

CVE-2020-13434 · Severity: critical · CVSS 9.8 · Published 2025-07-15

Technologies: Apple Tvos, Apple macOS, Apple Iphone Os, Apple watchOS, Apple Visionos, Apple iPadOS. Vendors: Siemens, Apple, NuGet, B&R Industrial Automation.

Executive brief

SQLite is a widely used database engine embedded in countless applications, mobile devices, and industrial systems. A vulnerability exists where specially crafted database queries can cause memory corruption, potentially allowing an attacker to crash applications or gain unauthorized control over a system. This affects a broad range of products including Apple mobile devices and Siemens industrial controllers that rely on the SQLite library.

Technical details

A numeric truncation error (CWE-197) in SQLite's expression handling (specifically in `expr.c`) allows for a memory corruption condition. The vulnerability occurs when a query contains a number of aggregate terms that exceeds the maximum number of columns available, leading to an out-of-bounds or inconsistent memory state. An attacker with the ability to execute arbitrary SQL queries—even with low privileges—could exploit this to achieve memory corruption. While the attack complexity is rated as high, successful exploitation could lead to a compromise of integrity and availability. The issue is resolved in SQLite version 3.50.2 by implementing immediate error checking when aggregate terms exceed column limits.

Affected products

SQLite SQLite versions before 3.50.2
Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) versions before V5.8
Siemens SIDIS Prime versions before V4.0.800
Apple iOS versions before 26.0.0
Apple iPadOS versions before 26.0.0
Apple macOS versions before 26.0.0

CVE identifiers

CVE-2020-13434
CVE-2020-13435
CVE-2018-8740
CVE-2018-20506
CVE-2015-3416
CVE-2016-6153
CVE-2020-11656
CVE-2020-13632
CVE-2020-13630
CVE-2017-10989
CVE-2020-13631
CVE-2020-11655
CVE-2022-35737
CVE-2020-15358
CVE-2019-8457
CVE-2015-3717
CVE-2018-20505
CVE-2018-20346
CVE-2015-5895
CVE-2023-7104
CVE-2019-19645
CVE-2019-19646
CVE-2025-3277
CVE-2025-6965
CVE-2015-6607

Timeline

2025-06-27: patched: Initial fix committed to SQLite trunk repository.
2025-07-15: disclosed: CVE published.
2025-09-15: advisory: Apple released security advisories for iOS and iPadOS 26 addressing the issue.