CVE-2025-3277 Integer overflow in sqlite
An integer overflow in SQLite's concat_ws function leads to a heap buffer overflow, allowing attackers to execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-3277?
CVE-2025-3277 is a medium-severity vulnerability in Sqlite Sqlite, published on 14 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
Which versions are affected by CVE-2025-3277?
1 open source package ship an affected version, including sqlite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sqlite Bitnami | From 3.44.0 | 3.49.1 |
Linux distribution packages (14)
sqlite AlmaLinux:10 | All versions | 3.46.1-4.el10_0 |
sqlite-devel AlmaLinux:10 | All versions | 3.46.1-4.el10_0 |
sqlite-libs AlmaLinux:10 | All versions | 3.46.1-4.el10_0 |
lemon-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite-analyzer-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite-devel Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite-libs Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite-libs-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite-tcl-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite-tools-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:3.46.1-4.el10_0 |
sqlite Rocky Linux:10 | All versions | 0:3.46.1-4.el10_0 |
Products include Sqlite Sqlite.
How do I fix CVE-2025-3277?
Upgrade sqlite to 3.49.1 or later.
Is CVE-2025-3277 being exploited?
There is no known exploitation of CVE-2025-3277 in the wild and no public exploit code.
Other vulnerabilities in Sqlite Sqlite
Sources
Also known as ALPINE-CVE-2025-3277, ALSA-2025:7517, BELL-CVE-2025-3277, BIT-sqlite-2025-3277, DEBIAN-CVE-2025-3277, GHSA-g2ph-wvc2-ph4v and 6 more.