CVE-2025-29087

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-29087
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

3.2 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a Third Party Advisory
https://sqlite.org/releaselog/3_49_1.html Release Notes
https://www.sqlite.org/cves.html Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
History

30 Apr 2025, 12:43

Type Values Removed Values Added
First Time Sqlite
Sqlite sqlite
CPE cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
References () https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a - () https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a - Third Party Advisory
References () https://sqlite.org/releaselog/3_49_1.html - () https://sqlite.org/releaselog/3_49_1.html - Release Notes
References () https://www.sqlite.org/cves.html - () https://www.sqlite.org/cves.html - Vendor Advisory

14 Apr 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 3.2
Summary (en) Sqlite 3.49.0 is susceptible to integer overflow through the concat function. (en) In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
References
  • () https://sqlite.org/releaselog/3_49_1.html -
  • () https://www.sqlite.org/cves.html -

08 Apr 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-190
Summary
  • (es) Sqlite 3.49.0 es susceptible al desbordamiento de enteros a través de la función concat.

07 Apr 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-07 20:15

Updated : 2025-04-30 12:43

NVD link : CVE-2025-29087

Mitre link : CVE-2025-29087

CVE.ORG link : CVE-2025-29087

JSON object : View

Products Affected

sqlite

  • sqlite
CWE
CWE-190

Integer Overflow or Wraparound