An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade v8-12.4-devel | May 9, 2025 | Apr 14, 2025 |
| Alpine Linux | — | Upgrade qt6-qtwebengineUpgrade sqlite | Aug 8, 2025 | Apr 14, 2025 |
| Debian | — | Upgrade sqlite3 | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade linux-c7-sqliteUpgrade sqlite3Upgrade linux_base-rl9 | Aug 3, 2025 | Aug 2, 2025 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory3 | Sep 25, 2025 | Jul 17, 2025 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libsUpgrade nodejsUpgrade v8-12.4-develUpgrade sqlite-libsUpgrade nodejs-packagingUpgrade sqlite-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade sqliteUpgrade nodejs-devel | May 7, 2025 | Apr 14, 2025 |
| Redhat_linux | — | Upgrade nodejsUpgrade sqlite-debugsourceUpgrade nodejs-nodemonUpgrade sqlite-tools-debuginfoUpgrade sqlite-libs-debuginfoUpgrade sqlite-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-docsUpgrade sqliteUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade sqlite-develUpgrade sqlite-libsUpgrade sqlite-tcl-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade sqlite-analyzer-debuginfoUpgrade nodejs-develUpgrade v8-12.4-develUpgrade lemon-debuginfoUpgrade npm | May 6, 2025 | Apr 14, 2025 |
| Rocky_linux | — | Upgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade sqlite-develUpgrade nodejsUpgrade nodejs-develUpgrade sqlite-libs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade sqlite-libsUpgrade sqlite-debuginfoUpgrade npmUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade sqliteUpgrade sqlite-debugsource | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade sqlite3-develUpgrade sqlite3Upgrade libsqlite3-0-32bitUpgrade sqlite3-docUpgrade libsqlite3-0Upgrade sqlite3-tclUpgrade libsqlite3-0-x86-64-v3 | May 8, 2025 | Apr 14, 2025 |
| Ubuntu | — | Upgrade libsqlite3-0 | May 26, 2025 | Apr 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub