CVE-2025-29088
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash).
Published Apr 10, 2025 · updated Oct 15, 2026 · sqlite sqlite
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 10, 2025 · NIST NVD
Detected
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Oct 15, 2026 · NIST NVD
Updated
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Affected
- cpe sqlite/sqlite3.49.0
Sources
- CVE.orgVulnerability recordCVE-2025-29088
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-29088
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2025-29088
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
nvd.nist.gov