CVE-2025-29087
published 2025-04-07CVE-2025-29087: In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.49%
38.8th percentile
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | sqlite3 | < sqlite3 3.46.1-3 (forky) | sqlite3 3.46.1-3 (forky) |
| ghost | sqlite3 | >= 0 < 3.46.1-3 | 3.46.1-3 |
| ghost | sqlite3 | >= 0 < 3.46.1-3 | 3.46.1-3 |
| ghost | sqlite3 | >= 0 < 3.31.1-4ubuntu0.7 | 3.31.1-4ubuntu0.7 |
| ghost | sqlite3 | >= 0 < 3.37.2-2ubuntu0.4 | 3.37.2-2ubuntu0.4 |
| ghost | sqlite3 | >= 0 < 3.45.1-1ubuntu2.3 | 3.45.1-1ubuntu2.3 |
| msrc | azl3_libdb_5.3.28-9_on_azure_linux_3.0 | — | — |
| msrc | azl3_sqlite_3.44.0-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libdb_5.3.28-7_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_sqlite_3.39.2-3_on_cbl_mariner_2.0 | — | — |
| sqlite | sqlite | >= 3.44.0 < 3.49.1 | 3.49.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian3.2LOW
vendor_msrc3.2LOW
vendor_redhat3.2LOW
vendor_ubuntu3.2LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
sqlite3 vulnerabilities
osv·2025-05-22·CVSS 7.5
CVE-2025-29087 [HIGH] sqlite3 vulnerabilities
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled the concat_ws() function.
An attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-29087,
CVE-2025-3277)
It was discovered that SQLite incorrectly handled certain argument values
to sqlite3_db_config(). An attacker could use this issue to cause SQLite to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-29088)
GHSA
GHSA-6j35-rq42-fv6v: Sqlite 3
ghsa_unreviewed·2025-04-07
CVE-2025-29087 [CRITICAL] CWE-190 GHSA-6j35-rq42-fv6v: Sqlite 3
Sqlite 3.49.0 is susceptible to integer overflow through the concat function.
OSV
CVE-2025-29087: In SQLite 3
osv·2025-04-07·CVSS 7.5
CVE-2025-29087 [HIGH] CVE-2025-29087: In SQLite 3
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
CISA ICS
Siemens RUGGEDCOM CROSSBOW Station Access Controller
cisa_ics·2025-08-14·CVSS 9.8
[CRITICAL] Siemens RUGGEDCOM CROSSBOW Station Access Controller
ICS Advisory
##
Siemens RUGGEDCOM CROSSBOW Station Access Controller
Release DateAugust 14, 2025
Alert CodeICSA-25-226-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 6.9
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM CROSSBOW Station Access Controller (SAC)
- Vulnerabilities: Heap-Based Buffer Overflow, Integer
Ubuntu
SQLite vulnerabilities
vendor_ubuntu·2025-05-22·CVSS 3.2
CVE-2025-29088 [LOW] SQLite vulnerabilities
Title: SQLite vulnerabilities
Summary: Several security issues were fixed in SQLite.
It was discovered that SQLite incorrectly handled the concat_ws() function.
An attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-29087,
CVE-2025-3277)
It was discovered that SQLite incorrectly handled certain argument values
to sqlite3_db_config(). An attacker could use this issue to cause SQLite to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-29088)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled
vendor_msrc·2025-04-08·CVSS 3.2
CVE-2025-29087 [LOW] CWE-190 In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work w
Red Hat
sqlite: Integer Overflow in SQLite concat_ws Function
vendor_redhat·2025-04-07·CVSS 3.2
CVE-2025-29087 [LOW] CWE-190 sqlite: Integer Overflow in SQLite concat_ws Function
sqlite: Integer Overflow in SQLite concat_ws Function
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
A flaw was found in SQLite. This vulnerability allows an attacker to cause an integer overflow via the concat_ws function.
Statement: The severity of this vulnerability is rated as Moderate, despite the potential for a severe outcome in unrestricted environments, primarily due to the limited impact observed within typical product deployments and the strong defense layers in
Debian
CVE-2025-29087: sqlite3 - In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can ...
vendor_debian·2025·CVSS 3.2
CVE-2025-29087 [LOW] CVE-2025-29087: sqlite3 - In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can ...
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 3.46.1-3)
sid: resolved (fixed in 3.46.1-3)
trixie: resolved (fixed in 3.46.1-3)
No detection rules found.
No public exploits indexed.
2025-04-07
Published