An embedded dependency is a third-party library or component packaged within another product. For example, an application or device may include SQLite rather than relying on a separately installed database. The dependency can have its own version, vulnerabilities, and patch cycle, even when users do not see it as a distinct product.
Embedded dependencies matter because a flaw in a widely used component can affect many products, while defenders may not know where or which version is present. Attackers may target a vulnerable component through the host product’s exposed features, but risk depends on the exact build, configuration, and reachable attack path. Security teams should inventory software components, check vendor advisories for bundled or backported fixes, and confirm patch status with product vendors. Updating a library may require a vendor product update rather than a direct change by the end user.