Back to Database
Status published
Low
CVE-2025-29087
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL...
Vulnerability Description
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-29087
Credits & Attribution
No credits recorded in the NVD database.
References
More from SQLite
View All →CVE-2025-7709
Out Of Bounds write in FTS5 Extension in SQLite
Medium
6.9
CVE-2025-7458
SQLite integer overflow in key info allocation may lead to information disclosure.
Medium
6.9
CVE-2025-71316
SQLite sqldiff remote code execution via argument injection
Critical
9.2
CVE-2025-6965
Integer Truncation on SQLite
High
7.2
CVE-2025-3277
An integer overflow can be triggered in SQLite’s `concat_ws()` function....
Medium
6.9
Affected Vendor
SQLite
View all reports →Affected Software
SQLite
Vulnerable Versions:
3.44.0
Timeline
Official Publish:
April 7th, 2025
Last Modified:
April 15th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L