CVE-2025-29087

Published Apr 7, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-29087 affects SQLite versions 3.44.0 through 3.49.0 before 3.49.1. The vulnerability lies within the `concat_ws()` SQL function. Specifically, the `concat_ws()` function is susceptible to an integer overflow when handling a separator argument controlled by an attacker. If the separator is a large string (e.g., 2MB or more), the integer overflow occurs during the calculation of the result buffer size, potentially leading to `malloc` allocating insufficient memory. This can then cause memory to be written beyond the allocated buffer.

Description: In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-190
nvd@nist.gov: CWE-190

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "42F127F3-9545-4944-86C7-38FE88E9DEBA",
            "versionEndExcluding": "3.49.1",
            "versionStartIncluding": "3.44.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.