“CVE-2022-35737 was introduced in SQLite version 1.0.12 (released on October 17, 2000) and fixed in release 3.39.2 (released on July 21, 2022).”
The bug sat in SQLite for 22 years. Pass a big enough string to SQLite’s own printf with %q and a 64-bit length gets squeezed into a 32-bit int, and in some builds that means arbitrary code execution. SQLite is one of the most heavily tested codebases on earth. C integer conversions still found a way.