CVE-2018-8740: SQLite memory corruption via aggregate term overflow

CVE-2018-8740 · Severity: critical · CVSS 9.8 · Published 2025-07-15

SQLite is a widely used database engine embedded in countless applications, mobile devices, and industrial systems. A vulnerability exists where specially crafted database queries can cause memory corruption, potentially allowing an attacker to crash applications or gain unauthorized control over a system. This affects a broad range of products including Apple mobile devices and Siemens industrial controllers that rely on the SQLite library.

Technologies: Apple iPadOS, Apple Iphone Os, Apple macOS, Apple Tvos, Apple Visionos, Apple watchOS, Siemens RUGGEDCOM CROSSBOW. Vendors: Apple, B&R Industrial Automation, NuGet, Siemens.

Quick answers

Is CVE-2018-8740 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-8740 being exploited in the wild.
How severe is CVE-2018-8740?
Critical severity, with a CVSS score of 9.8, published 15 July 2025.
Which products and versions are affected?
Apple iPadOS versions before 26.0.0; Apple macOS versions before 26.0.0; B&R Industrial Automation Automation Studio < 6.5, 6.5; SQLitePCLRaw.lib.e_sqlite3 (NuGet) <= 2.1.11, ECOSYSTEM:introduced=0,last_affected=2.1.11; and 4 more.
Is there a fix for CVE-2018-8740?
A patch was published on 2025-06-27: Initial fix committed to SQLite trunk repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-8740 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2018-8740?
Check whether you run Apple iPadOS, Apple Iphone Os, Apple macOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A numeric truncation error (CWE-197) in SQLite's expression handling (specifically in `expr.c`) allows for a memory corruption condition. The vulnerability occurs when a query contains a number of aggregate terms that exceeds the maximum number of columns available, leading to an out-of-bounds or inconsistent memory state. An attacker with the ability to execute arbitrary SQL queries—even with low privileges—could exploit this to achieve memory corruption. While the attack complexity is rated as high, successful exploitation could lead to a compromise of integrity and availability. The issue is resolved in SQLite version 3.50.2 by implementing immediate error checking when aggregate terms exceed column limits.

Affected products

  • SQLite SQLite versions before 3.50.2
  • Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) versions before V5.8
  • Siemens SIDIS Prime versions before V4.0.800
  • Apple iOS versions before 26.0.0
  • Apple iPadOS versions before 26.0.0
  • Apple macOS versions before 26.0.0

Identifiers

  • CVE-2018-8740
  • CVE-2016-6153
  • CVE-2020-11656
  • CVE-2017-10989
  • CVE-2020-13630
  • CVE-2020-11655
  • CVE-2020-13631
  • CVE-2015-3717
  • CVE-2019-8457
  • CVE-2018-20505
  • CVE-2026-11824
  • CVE-2018-20346
  • CVE-2023-7104
  • CVE-2025-70873
  • CVE-2025-3277
  • CVE-2026-11822
  • CVE-2020-13434
  • CVE-2020-13435
  • CVE-2025-71316
  • CVE-2015-3416
  • CVE-2018-20506
  • CVE-2020-13632
  • CVE-2020-15358
  • CVE-2022-35737
  • CVE-2015-5895
  • CVE-2019-19645
  • CVE-2019-19646
  • CVE-2025-6965
  • CVE-2015-6607
  • GHSA-2m69-gcr7-jv3q

Timeline

  • 2025-06-27: patched: Initial fix committed to SQLite trunk repository.
  • 2025-07-15: disclosed: CVE published.
  • 2025-09-15: advisory: Apple released security advisories for iOS and iPadOS 26 addressing the issue.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.