CVE-2025-7458

What it actually does

Integer overflow in sqlite3KeyInfoFromExprList triggers memory corruption, enabling denial of service or arbitrary sensitive information disclosure from process memory when processing a crafted SELECT with an excessively large ORDER BY expression list.

Why it matters to the business

Applications relying on the affected database components on AlmaLinux 8 can experience service outages or memory data leaks if an attacker gains SQL execution access; the broad package footprint increases exposure surface across many dependent systems.

How an attack unfolds

An attacker who can issue arbitrary SQL submits a SELECT statement engineered with a very large number of expressions in the ORDER BY clause, causing the integer overflow during key info construction and resulting in either a crash or leakage of adjacent process memory.

How to fix it

Upgrade the listed AlmaLinux 8 packages to the exact fixed module versions provided (for example xml-commons-apis to 1.4.01-25.module_el8.5.0+2577+9e95fe00, slf4j to 1.7.25-4.module_el8.5.0+2577+9e95fe00, and similarly for all other affected packages).

How to confirm the fix worked

Confirm installed package versions match the fixed module releases, review application query patterns for oversized ORDER BY clauses, and re-test the vulnerable code path with controlled large expression lists after patching.

Typical attack path

1. Gain the ability to execute arbitrary SQL statements against the target database
2. Construct a malicious SELECT query containing an abnormally large ORDER BY expression list
3. Submit the query to trigger the integer overflow in sqlite3KeyInfoFromExprList
4. Observe denial of service or harvest sensitive information leaked from process memory

How to detect it

Inspect database query logs and application SQL audit trails for SELECT statements containing an abnormally high number of expressions in the ORDER BY clause; correlate with process crashes or unexpected memory access patterns.

What your security team should do

• Apply the listed fixed package versions immediately across all AlmaLinux 8 systems
• Restrict arbitrary SQL execution privileges to the minimum required accounts
• Add monitoring for unusually large ORDER BY clauses in database and application logs
• Review downstream dependents to identify additional impacted deployments