Integer Overflow Vulnerability in Sqlite 3.49.0
Summary
CVE-2025-29087: In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. Affects sqlite across 2 version ranges.
< 3.44.2-r1
>= 66476771b77e3c0df9d406d912486c43ac726fab, < 3cd92ce875fd4e5601e535c35fef33494a6684e3
Fixed in 3.44.2-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sqlite is a widely used open-source database engine that provides a lightweight, serverless, self-contained SQL database. It is known for its simplicity and efficiency, making it a popular choice for applications ranging from small embedded systems to large-scale web applications. The vulnerability in question affects versions of Sqlite starting from 3.49.0, where an integer overflow can occur through the concat function, potentially leading to unexpected behavior or security issues.
Vulnerability Detail
The vulnerability identified as CVE-2025-29087 arises from an integer overflow in the concat function of Sqlite 3.49.0. This flaw can be exploited by attackers to manipulate database operations, potentially leading to data corruption or unauthorized access. The integer overflow occurs when the function processes large input values, resulting in incorrect calculations and behavior. This vulnerability poses significant risks, especially in applications that rely on Sqlite for data integrity and security.
How To Fix
Minimum fixed version
3.44.2-r1
This is the first release that contains the fix.
sudo apk add --upgrade sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the concat function with large input values until an update can be applied. Additionally, implementing input validation to restrict the size of inputs passed to the concat function may help mitigate the risk of exploitation.
Conclusion
The integer overflow vulnerability in Sqlite 3.49.0 poses significant risks to applications relying on this database engine. Users are encouraged to update to a patched version to ensure the integrity and security of their data. Temporary workarounds can help mitigate risks until an update is applied.
See every vulnerability recorded for sqlite →
FAQ
CVE-2025-29087 is a vulnerability in Sqlite 3.49.0 that allows for integer overflow through the concat function, potentially leading to security issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to data corruption, unauthorized access, and unexpected behavior in applications using Sqlite.
Yes, users are advised to update to a version of Sqlite higher than 3.49.0 to mitigate the vulnerability.
As a temporary measure, avoid using the concat function with large inputs and implement input validation to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
