Resolving CVE-2025-6965 in C1.FlexReport While Preserving AnyCPU Compatibility
Overview
A vulnerability scan identified CVE-2025-6965 (GitHub Advisory GHSA-2m69-gcr7-jv3q) in a transitive dependency used by C1.FlexReport. The issue originated from SQLitePCLRaw.lib.e_sqlite3 2.1.10, which was brought in through Microsoft.Data.Sqlite 9.0.5.
Although the vulnerability was discovered during internal NuGet auditing before any ComponentOne user reports, remediation required more than a simple package upgrade because the available fix introduced breaking changes for .NET Framework AnyCPU projects.
Affected Components and Resolution
The following were affected by the vulnerable dependency chain:
- C1.FlexReport
- FlexReportDesigner applications
- Any application that references C1.FlexReport directly or transitively
Root Cause, Impact and Compatibility
The vulnerability existed in the native SQLite library bundled with SQLitePCLRaw.lib.e_sqlite3 2.1.10. At the time of discovery, all releases in the 2.x package line were covered by the advisory, leaving no non-vulnerable upgrade path within that version family.
Since Microsoft.Data.Sqlite does not directly expose the native SQLite package, upgrading the managed package alone could not guarantee deployment of a patched native library.
Updating to SQLitePCLRaw.bundle_e_sqlite3 3.0.3 introduced a known limitation in SQLitePCLRaw 3.x for .NET Framework AnyCPU projects. By default, the package requires applications to target a specific platform (x86 or x64) because it cannot automatically determine which native SQLite binary should be deployed during an AnyCPU build.
To prevent this change from affecting customers, C1.FlexReport now includes its own compatibility layer. The package deploys the required native SQLite binaries for x86, x64, and ARM64, detects the runtime architecture automatically, and loads the appropriate library at startup.
As a result, applications that use C1.FlexReport can continue to target AnyCPU and require no project changes. The platform-targeting restriction imposed by SQLitePCLRaw 3.x is handled internally by C1.FlexReport, preserving the existing development and deployment experience while still resolving the vulnerability.
A build-time notification is included in the package to explain the implementation and to advise developers to target a specific platform only if they encounter unexpected environment-specific issues.