[CVE-2022-35737] Stranger Strings: An exploitable flaw in SQLite

CVE

CVE-2022-35737

Published

2022-10-25 11:30

Collected

2026-07-03 04:04

---
id: 1740
title: "[CVE-2022-35737] Stranger Strings: An exploitable flaw in SQLite"
cve: CVE-2022-35737
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/"
published_at: "2022-10-25T11:30:10Z"
tags: ["memory-safety", "cve", "vulnerability-disclosure", "sqlite"]
phying_url: "https://phying.com/item/1740"
lang: en
---

# [CVE-2022-35737] Stranger Strings: An exploitable flaw in SQLite

## Summary

Trail of Bits discloses CVE-2022-35737 in SQLite's printf implementation: present since 2000, fixed in 3.39.2. Large strings with %Q/%q/%w format types cause crashes on 64-bit systems, and the ! unicode flag enables worst-case arbitrary code execution.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **CVE:** CVE-2022-35737
- **Published:** 2022-10-25T11:30:10Z
- **Original:** https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
- **Phying News:** https://phying.com/item/1740