CVE-2025-3277 Information

Description

An integer overflow can be triggered in SQLite’s concat_ws() function. The resulting truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer it uses the original untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.

Reference

https://sqlite.org/src/info/498e3f1cf57f164f