An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | May 9, 2025 | Apr 14, 2025 |
| Alpine Linux | — | Upgrade sqliteUpgrade qt6-qtwebengine | Aug 8, 2025 | Apr 14, 2025 |
| Debian | — | Upgrade sqlite3 | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade linux-c7-sqliteUpgrade linux_base-rl9Upgrade sqlite3 | Aug 3, 2025 | Aug 2, 2025 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory3 | Sep 25, 2025 | Jul 17, 2025 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade sqlite-libsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade sqlite-develUpgrade nodejs-full-i18nUpgrade sqliteUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundler | May 7, 2025 | Apr 14, 2025 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-libsUpgrade sqliteUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade sqlite-tools-debuginfoUpgrade sqlite-libs-debuginfoUpgrade nodejs-packagingUpgrade sqlite-debugsourceUpgrade sqlite-debuginfoUpgrade sqlite-analyzer-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade v8-12.4-develUpgrade lemon-debuginfoUpgrade sqlite-develUpgrade sqlite-libsUpgrade sqlite-tcl-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundler | May 6, 2025 | Apr 14, 2025 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade sqlite-debuginfoUpgrade v8-12.4-develUpgrade sqliteUpgrade sqlite-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade sqlite-libs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade sqlite-libsUpgrade nodejs-debugsourceUpgrade sqlite-devel | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade sqlite3-develUpgrade sqlite3-docUpgrade libsqlite3-0-32bitUpgrade libsqlite3-0Upgrade libsqlite3-0-x86-64-v3Upgrade sqlite3Upgrade sqlite3-tcl | May 8, 2025 | Apr 14, 2025 |
| Ubuntu | — | Upgrade libsqlite3-0 | May 26, 2025 | Apr 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub