PT-2025-16260 · Sqlite+9 · Sqlite+9
Published
2025-02-15
·
Updated
2026-02-20
·
CVE-2025-3277
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
SQLite (affected versions not specified)
Description:
An integer overflow can be triggered in SQLite's
concat ws() function, leading to a Heap Buffer overflow of size ~4GB, which can result in arbitrary code execution. This occurs because the resulting, truncated integer is used to allocate a buffer, but SQLite then writes the resulting string to the buffer using the original, untruncated size.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Heap Based Buffer Overflow
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Ibm Aix
Linuxmint
Red Hat
Rocky Linux
Sqlite
Suse
Ubuntu