C:\Windows\System32\winsqlite3.dll CVE-2025-6965 vulnerability patch release on Windows 2019 and Windows 2022 server

Hello Bhavesh Kapadia

The issue you are countering with CVE-2025-6965 regarding winsqlite3.dll is a common scenario involving the discrepancy between upstream open-source component versioning and Microsoft's internal release cycle. winsqlite3.dll is a protected operating system file governed by Windows Resource Protection (WRP). You strictly can't and must not manually replace this file with a standard SQLite DLL (version 3.50.2) downloaded from the internet. Doing so will fail signature validation, violate system integrity, and likely break Windows services that rely on Microsoft-specific APIs within that library.

Microsoft remediates these vulnerabilities through the monthly Cumulative Updates (LCU), typically released on "Patch Tuesday" (the second Tuesday of every month). Crucially, Microsoft often utilizes "backporting" for these fixes. This means they apply the specific security code patch to their existing stable version (e.g., 3.43.2.0) without upgrading the entire library to the new upstream version (3.50.2) to maintain stability and compatibility. Consequently, vulnerability scanners that rely on naive version checks will flag the file as vulnerable even if it is fully patched, resulting in a false positive.

To confirm the patch status, ensure the server or workstation has the latest Cumulative Update installed via Windows Update or WSUS. Once updated, if your vulnerability scanner still flags the file, you should cross-reference the CVE ID in the Microsoft Security Update Guide. If the CVE is listed as resolved in a recent KB but the file version hasn't jumped to 3.50.2, you can confidently mark the finding as a false positive or an exception in your auditing tool, citing that the patch is managed by the OS vendor (Microsoft) via backporting. If the CVE isn't yet listed in the Security Update Guide, it indicates Microsoft is either still investigating the impact or has determined the vulnerability isn't exploitable in the Windows implementation.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP

The vulnerability is fixed in the following KBs:

For Windows Server 2025 - January 13, 2026—KB5073379

For Windows Server 2022 - January 13, 2026—KB5073457

For Windows Server 2019 - extended support for OS - fix KB - January 13, 2026—KB5073723

Note from KB5073723: You must have installed the August 10, 2021 SSU (KB5005112) before installing this cumulative update.

For Windows Server 2016 - extended support for OS - fix KB - January 13, 2026—KB5073722

Note from KB5073722: Until you install the SSU, this update might not be offered to your device … If you are a Windows Server Update Services (WSUS) administrator, you must approve SSU KB5073447 and this update KB5073722.

Hi Bhavesh Kapadia,

I'm checking in to see if you have had the opportunity to deploy the January 2026 Cumulative Update (released Jan 13) to your environment. As previously noted, this update package contains the backported security fix for the winsqlite3.dll vulnerability in question. Please verify that the update has been successfully installed and the server has been rebooted to release the file lock on the system binaries.

After the reboot, inspect the details of C:\Windows\System32\winsqlite3.dll. While the version number will not match the open-source SQLite v3.50.2 release due to Microsoft's branching strategy, the file date should reflect the January 2026 timestamp. If your vulnerability scanner continues to flag the asset after the update, you must update the scanner's definition database, as it is likely triggering a false positive based on an obsolete version check rather than detecting the actual vulnerability signature.

If the issue has been successfully resolved, please consider accepting the answer as it helps other people sharing the same question benefit too. Thank you!

VP