Vulnerability Description
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sqlite | Sqlite | >= 3.44.0, < 3.49.1 |
Related Weaknesses (CWE)
References
- https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62aThird Party Advisory
- https://sqlite.org/releaselog/3_49_1.htmlRelease Notes
- https://www.sqlite.org/cves.htmlVendor Advisory
FAQ
What is CVE-2025-29087?
CVE-2025-29087 is a vulnerability with a CVSS score of 3.2 (LOW). In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled...
How severe is CVE-2025-29087?
CVE-2025-29087 has been rated LOW with a CVSS base score of 3.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-29087?
Check the references section above for vendor advisories and patch information. Affected products include: Sqlite Sqlite.