SQLite integer truncation found with Google Big Sleep, cut off before exploitation

What happened

An integer truncation in SQLite before 3.50.2 where the number of aggregate terms could exceed the columns available, published by Google as CNA on 15 July 2025. Google says the flaw was known only to threat actors and about to be used, and that Big Sleep with Threat Intelligence Group input identified it first.

Credit as recorded: Vlad Stolyarov of Google's Threat Analysis Group, with assistance from Google Big Sleep. The credit names a human researcher with assistance from the agent, so the flagship result is human-plus-agent while the routine Big Sleep records name the agent alone. Date basis: datePublic.