Memory Overflow Vulnerability in SQLite3 Package: CVE-2025-29087
Summary
UBUNTU-CVE-2025-29087: In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. Affects sqlite3 versions < 3.45.1-1ubuntu2.3. Fixed in 3.45.1-1ubuntu2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SQLite3 is a widely used database engine that provides a lightweight, serverless, self-contained SQL database engine. It is popular for its simplicity and efficiency, making it a common choice for applications requiring a local database. However, certain versions of SQLite3 are vulnerable to a memory overflow issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-29087 affects SQLite versions 3.44.0 through 3.49.0 before 3.49.1. It arises from the concat_ws() SQL function, which can lead to memory being written beyond the end of a malloc-allocated buffer. If an attacker controls the separator argument and provides a large string (e.g., 2MB or more), it can cause an integer overflow when calculating the size of the result buffer. This may result in insufficient memory allocation, leading to potential exploitation and system instability.
How To Fix
Minimum fixed version
3.45.1-1ubuntu2.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlite3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the concat_ws() function with user-controlled input for the separator argument until the package can be updated. This can help mitigate the risk of exploitation.
Conclusion
In summary, CVE-2025-29087 is a critical vulnerability in SQLite3 that can lead to memory overflow issues. It is essential to update to the patched version to protect your applications from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for sqlite3 →
FAQ
CVE-2025-29087 is a vulnerability in SQLite3 that can lead to memory overflow due to improper handling of the concat_ws() function.
The affected versions are SQLite3 versions 3.44.0 through 3.49.0 before 3.49.1.
Exploitation of this vulnerability can lead to memory corruption, application crashes, and potential unauthorized access to sensitive data.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by this vulnerability. Visit Vulert Scanner for more information.
Yes, avoid using the concat_ws() function with user-controlled input for the separator argument until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
