CVE-2025-29088 Integer overflow in SQLite
An integer overflow in SQLite's configuration API can cause incorrect memory allocations, leading to an application crash and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-29088?
CVE-2025-29088 is a medium-severity vulnerability in Sqlite Sqlite, published on 10 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Weakness: CWE-190
Which versions are affected by CVE-2025-29088?
1 open source package ship an affected version, including sqlite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sqlite Bitnami | From 3.49.0 | None |
Products include Sqlite Sqlite.
How do I fix CVE-2025-29088?
Upgrade to a fixed version.
Is CVE-2025-29088 being exploited?
There is no known exploitation of CVE-2025-29088 in the wild and no public exploit code.
Other vulnerabilities in Sqlite Sqlite
Sources
Also known as ALPINE-CVE-2025-29088, BELL-CVE-2025-29088, BIT-sqlite-2025-29088, CLSA-2025-1755113204, CLSA-2025-1755885175, CVE-2025-52099 and 7 more.