In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 7, 2025 · NIST NVD

   Detected

   In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

2. Oct 15, 2026 · NIST NVD

   Updated

   In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

Affected

• cpe sqlite/sqliteversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-29087

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-29087

  30-day exploitation probability 0.5%

  first.org
• NIST NVDVulnerability recordCVE-2025-29087

  In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calcu

  nvd.nist.gov

References

• Reference · cert-portal.siemens.com
• Reference · cert-portal.siemens.com
• Third Party Advisory · gist.github.com
• Release Notes · sqlite.org
• Vendor Advisory · sqlite.org