An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejsUpgrade v8-12.4-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npm | May 9, 2025 | Apr 14, 2025 |
| Alpine Linux | — | Upgrade qt6-qtwebengineUpgrade sqlite | Aug 8, 2025 | Apr 14, 2025 |
| Debian | — | Upgrade sqlite3 | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade sqlite3Upgrade linux-c7-sqliteUpgrade linux_base-rl9 | Aug 3, 2025 | Aug 2, 2025 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory3 | Sep 25, 2025 | Jul 17, 2025 |
| Oracle_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade v8-12.4-develUpgrade sqliteUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade sqlite-libsUpgrade nodejs-nodemonUpgrade sqlite-develUpgrade nodejs-devel | May 7, 2025 | Apr 14, 2025 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade sqlite-libs-debuginfoUpgrade nodejsUpgrade nodejs-nodemonUpgrade sqliteUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade sqlite-debugsourceUpgrade sqlite-debuginfoUpgrade sqlite-tools-debuginfoUpgrade sqlite-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade sqlite-analyzer-debuginfoUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade lemon-debuginfoUpgrade sqlite-develUpgrade sqlite-tcl-debuginfoUpgrade v8-12.4-devel | May 6, 2025 | Apr 14, 2025 |
| Rocky_linux | — | Upgrade sqlite-develUpgrade nodejsUpgrade nodejs-debugsourceUpgrade sqlite-libsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade sqlite-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade sqlite-debugsourceUpgrade sqlite-debuginfoUpgrade npmUpgrade v8-12.4-develUpgrade sqlite | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade sqlite3-develUpgrade libsqlite3-0Upgrade libsqlite3-0-x86-64-v3Upgrade sqlite3-tclUpgrade sqlite3-docUpgrade sqlite3Upgrade libsqlite3-0-32bit | May 8, 2025 | Apr 14, 2025 |
| Ubuntu | — | Upgrade libsqlite3-0 | May 26, 2025 | Apr 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub