An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-libsalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-nodejs-packaging-bundleralma-upgrade-npmalma-upgrade-v8-12.4-devel | May 9, 2025 | Apr 14, 2025 | |
| Alpine Linux | alpine-linux-upgrade-sqlitealpine-linux-upgrade-qt6-qtwebengine | Aug 8, 2025 | Apr 14, 2025 | |
| Freebsd | freebsd-upgrade-package-sqlite3freebsd-upgrade-package-linux-c7-sqlitefreebsd-upgrade-package-linux_base-rl9 | Aug 3, 2025 | Aug 2, 2025 | |
| Ibm Aix | ibm-aix-rpm_advisory3 | Sep 25, 2025 | Jul 17, 2025 | |
| Oracle_linux | — | oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-libsoracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-nodejs-packaging-bundleroracle-linux-upgrade-npmoracle-linux-upgrade-sqliteoracle-linux-upgrade-sqlite-develoracle-linux-upgrade-sqlite-libsoracle-linux-upgrade-v8-12-4-devel | May 7, 2025 | Apr 14, 2025 |
| Redhat_linux | redhat-upgrade-lemon-debuginforedhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-libsredhat-upgrade-nodejs-libs-debuginforedhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-nodejs-packaging-bundlerredhat-upgrade-npmredhat-upgrade-sqliteredhat-upgrade-sqlite-analyzer-debuginforedhat-upgrade-sqlite-debuginforedhat-upgrade-sqlite-debugsourceredhat-upgrade-sqlite-develredhat-upgrade-sqlite-libsredhat-upgrade-sqlite-libs-debuginforedhat-upgrade-sqlite-tcl-debuginforedhat-upgrade-sqlite-tools-debuginforedhat-upgrade-v8-12-4-devel | May 6, 2025 | Apr 14, 2025 | |
| Rocky_linux | rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-nodejs-libsrocky-upgrade-nodejs-libs-debuginforocky-upgrade-npmrocky-upgrade-sqliterocky-upgrade-sqlite-debuginforocky-upgrade-sqlite-debugsourcerocky-upgrade-sqlite-develrocky-upgrade-sqlite-libsrocky-upgrade-sqlite-libs-debuginforocky-upgrade-v8-12.4-devel | Jul 31, 2025 | Jul 29, 2025 | |
| Suse | — | suse-upgrade-libsqlite3-0suse-upgrade-libsqlite3-0-32bitsuse-upgrade-libsqlite3-0-x86-64-v3suse-upgrade-sqlite3suse-upgrade-sqlite3-develsuse-upgrade-sqlite3-docsuse-upgrade-sqlite3-tcl | May 8, 2025 | Apr 14, 2025 |
| Ubuntu | ubuntu-upgrade-libsqlite3-0 | May 26, 2025 | Apr 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub