diff --git a/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch b/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch
new file mode 100644
index 000000000000..27ab2af2014a
--- /dev/null
+++ b/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch
@@ -0,0 +1,25 @@
+adapted for preprocessed source files from upstream
+https://sqlite.org/src/vpatch?from=a60e56627fc0ef88&to=cefc032473ac5ad2
+
+diff --git a/shell.c b/shell.c
+index e66ae08..d423278 100644
+--- a/shell.c
++++ b/shell.c
+@@ -12921,7 +12921,7 @@ static int safeModeAuth(
+     "zipfile",
+     "zipfile_cds",
+   };
+-  UNUSED_PARAMETER(zA2);
++  UNUSED_PARAMETER(zA1);
+   UNUSED_PARAMETER(zA3);
+   UNUSED_PARAMETER(zA4);
+   switch( op ){
+@@ -12936,7 +12936,7 @@ static int safeModeAuth(
+     case SQLITE_FUNCTION: {
+       int i;
+       for(i=0; i<ArraySize(azProhibitedFunctions); i++){
+-        if( sqlite3_stricmp(zA1, azProhibitedFunctions[i])==0 ){
++        if( sqlite3_stricmp(zA2, azProhibitedFunctions[i])==0 ){
+           failIfSafeMode(p, "cannot use the %s() function in safe mode",
+                          azProhibitedFunctions[i]);
+         }
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 70b8c777e978..36753e419a8a 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -21,7 +21,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-WvB96YK6ZY/ZGgMXDJRfmclx9pVbx53zJmVENz45hpw=";
   };
 
-  patches = [ ./CVE-2022-35737.patch ];
+  patches = [
+    ./CVE-2022-35737.patch
+    ./3.39.4-autoconf-CVE-2022-46908.patch
+  ];
 
   outputs = [ "bin" "dev" "out" ];
   separateDebugInfo = stdenv.isLinux;