CVE-2020-35525

What it actually does

Null pointer dereference during INTERSECT query processing in SQLite leads to memory corruption and process termination.

Why it matters to the business

Database-backed applications and services can be made unavailable through crafted queries, resulting in operational downtime and potential data access loss until the instance is restarted.

How an attack unfolds

An attacker with the ability to submit SQL statements to a vulnerable SQLite instance crafts an INTERSECT query that triggers the null pointer dereference, causing an immediate crash and denial of service.

How to fix it

Upgrade SQLite to the latest available version that resolves the null pointer dereference in INTERSECT processing; apply vendor patches or rebuild dependent applications with the fixed library.

How to confirm the fix worked

Execute regression test suites containing INTERSECT queries against the updated SQLite build and confirm absence of crashes; perform fuzzing or static analysis targeting the INTERSECT code path.

Typical attack path

1. Identify an application or service exposing SQLite query interfaces
2. Submit a crafted SQL statement containing an INTERSECT clause designed to dereference a null pointer
3. Observe application or process crash resulting in denial of service

How to detect it

Review application and database logs for unexpected SQLite process terminations or segmentation faults correlated with INTERSECT queries; inspect crash dumps for null dereference signatures in query processing code.

What your security team should do

• Prioritize upgrade of all SQLite instances to a patched release
• Restrict untrusted SQL execution surfaces where possible
• Implement query logging and anomaly detection for INTERSECT usage patterns
• Monitor EPSS and exploit maturity indicators for any future increase in risk