An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade v8-12.4-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-libs | May 9, 2025 | Apr 14, 2025 |
| Alpine Linux | — | Upgrade sqliteUpgrade qt6-qtwebengine | Aug 8, 2025 | Apr 14, 2025 |
| Debian | — | Upgrade sqlite3 | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade linux_base-rl9Upgrade linux-c7-sqliteUpgrade sqlite3 | Aug 3, 2025 | Aug 2, 2025 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory3 | Sep 25, 2025 | Jul 17, 2025 |
| Oracle_linux | — | Upgrade sqliteUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade sqlite-develUpgrade nodejs-packagingUpgrade sqlite-libsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade npm | May 7, 2025 | Apr 14, 2025 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade lemon-debuginfoUpgrade nodejs-packaging-bundlerUpgrade sqlite-libsUpgrade sqlite-develUpgrade nodejs-debugsourceUpgrade sqlite-tcl-debuginfoUpgrade npmUpgrade nodejs-debuginfoUpgrade v8-12.4-develUpgrade sqlite-analyzer-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade sqlite-debuginfoUpgrade nodejsUpgrade sqliteUpgrade nodejs-docsUpgrade sqlite-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade sqlite-debugsourceUpgrade sqlite-tools-debuginfo | May 6, 2025 | Apr 14, 2025 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade sqlite-libsUpgrade nodejs-debuginfoUpgrade sqlite-libs-debuginfoUpgrade sqlite-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-libsUpgrade v8-12.4-develUpgrade sqlite-debuginfoUpgrade nodejs-full-i18nUpgrade sqlite-debugsourceUpgrade npmUpgrade sqlite | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade sqlite3-develUpgrade sqlite3-docUpgrade sqlite3-tclUpgrade libsqlite3-0Upgrade libsqlite3-0-32bitUpgrade sqlite3Upgrade libsqlite3-0-x86-64-v3 | May 8, 2025 | Apr 14, 2025 |
| Ubuntu | — | Upgrade libsqlite3-0 | May 26, 2025 | Apr 14, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub