CVE-2025-6965: SQLite Aggregate-Term Truncation Reaches Siemens RUGGEDCOM CROSSBOW SAC

CVE-2025-6965 is an integer truncation error in SQLite before version 3.50.2: when a query's aggregate-term count exceeds the number of available columns, SQLite can corrupt memory, and Siemens ships this vulnerable SQLite build inside its RUGGEDCOM CROSSBOW Station Access Controller (SAC), all versions before V6.0. NVD has published its own CVSS v3.1 score of 7.7 (HIGH), the CVE is not on CISA's KEV catalog, and the high 73%-plus EPSS figure most plausibly reflects SQLite's enormous overall deployment footprint rather than confirmed attacker interest in this specific OT product.

CVE-2025-6965 is a numeric truncation error (CWE-197) in SQLite's aggregate-query handling before version 3.50.2. NVD's description states: "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above" (NVD). The SQLite project's own fix check-in hardens the aggregate-term-to-column-count path against this mismatch (SQLite fix commit).

NVD lists a Primary (NVD-assigned) CVSS v3.1 score of 7.7 (HIGH), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L — network-reachable but requiring high attack complexity and low privileges, with a changed security scope (NVD). NVD's own configuration data for this CVE also lists Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS builds before version 26.0.0 as affected because they embed the same SQLite library (NVD) — a reminder that the exploitation signal below reflects interest in the underlying SQLite flaw across a huge installed base, not evidence of targeting aimed at industrial control systems specifically.

On the OT side, NVD's own configuration data for this CVE lists two Siemens products as vulnerable: RUGGEDCOM CROSSBOW before version 5.8, and SIDIS PRIME before version 4.0.800 (NVD). Siemens' own PSIRT advisory SSA-765416, scoped specifically to the CROSSBOW Station Access Controller (SAC) sub-component, confirms it ships this vulnerable SQLite build alongside four other third-party library CVEs (CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824), and states that updating to V6.0 or later is the only documented fix for SAC, with no interim workaround beyond normal network access restriction (Siemens PSIRT Advisory SSA-765416) — the V6.0 SAC fix version and NVD's 5.8 base-product figure describe different components of the same CROSSBOW suite rather than a contradiction. CISA republished the SAC advisory as ICSA-26-295-15 on 2026-10-22 (CISA ICS Advisory ICSA-26-295-15). We did not find a separate public Siemens or CISA advisory for the SIDIS PRIME exposure beyond NVD's own configuration entry.

CVE-2025-6965 is not on the CISA Known Exploited Vulnerabilities catalog. As of 2026-10-28, FIRST scores the probability of exploitation at 0.7345 (99.463th percentile) — a very high figure for a CVE with no KEV listing, consistent with broad scanning or research interest in the widely-deployed SQLite library rather than confirmed exploitation of the RUGGEDCOM SAC application itself (FIRST EPSS).

Because the vulnerable SQLite build sits inside a station access controller on OT networks, sites running RUGGEDCOM CROSSBOW SAC before V6.0 should upgrade regardless of the ambiguous exploitation signal; network segmentation alone does not mitigate a flaw in a locally-loaded data-handling library.

• SQLite before 3.50.2 contains a numeric truncation error where aggregate term count can exceed available columns, leading to memory corruption; fixed in 3.50.2. — NVD
• NVD's Primary CVSS v3.1 score is 7.7 (HIGH), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L; NVD's own configuration data lists Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS before 26.0.0 as also affected via the same SQLite library. — NVD
• NVD's own configuration data lists Siemens RUGGEDCOM CROSSBOW before 5.8 and Siemens SIDIS PRIME before 4.0.800 as affected; Siemens PSIRT advisory SSA-765416 (scoped to the CROSSBOW Station Access Controller sub-component) confirms the bundled SQLite and states the fix is V6.0 or later. — Siemens PSIRT Advisory SSA-765416
• CISA republished the Siemens advisory as ICSA-26-295-15 on 2026-10-22, covering RUGGEDCOM CROSSBOW Station Access Controller. — CISA ICS Advisory ICSA-26-295-15
• EPSS score is 0.7345 (99.463th percentile) as of 2026-10-28, and the CVE is not on CISA KEV. — FIRST EPSS