Read the docs
TI-2025-02869 Aliases CVE-2025-3277GHSA-g2ph-wvc2-ph4v

Heap-based buffer overflow in sqlite

Priority LOW 33CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01252 69th percentileScored 2026-11-07
Fix Fixed sqlite (SQLite): 3.49.1Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SQLitesqlitebefore 3.49.13.49.1Patch availableCNA
  • sqlite VendorSQLite Affected before 3.49.1 Fixed in 3.49.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*3.44.0 to before 3.49.1VulnerableSQLite
  • cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* Versions 3.44.0 to before 3.49.1 Vulnerable ·SQLite

Remediation

  • Fix · CNA sqlite (SQLite) Fixed in 3.49.1

Red Hat 3 advisories

  • RHSA-2025:7517 Released 2025-05-13 · Red Hat rating Important
    sqlite security update
    • Red Hat Enterprise Linux AppStream (v. 10) sqlite-3.46.1-4.el10_0, sqlite-devel-3.46.1-4.el10_0
    • Red Hat Enterprise Linux BaseOS (v. 10) sqlite-3.46.1-4.el10_0, sqlite-libs-3.46.1-4.el10_0
  • RHSA-2025:7433 Released 2025-05-13 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.15.0-1.module+el9.6.0+23062+9e7801b9.aarch64::nodejs:22, nodejs-1:22.15.0-1.module+el9.6.0+23062+9e7801b9.ppc64le::nodejs:22, nodejs-1:22.15.0-1.module+el9.6.0+23062+9e7801b9.s390x::nodejs:22 +28
  • RHSA-2025:4459 Released 2025-05-05 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.15.0-1.module+el8.10.0+23068+28ff2340.aarch64::nodejs:22, nodejs-1:22.15.0-1.module+el8.10.0+23068+28ff2340.ppc64le::nodejs:22, nodejs-1:22.15.0-1.module+el8.10.0+23068+28ff2340.s390x::nodejs:22 +28

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:7517
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:4459
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:7433
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:7517
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3277
  2. 2026-10-03 Alias added: GHSA-g2ph-wvc2-ph4v

References

Patch 1

  • TI-2026-82983 Heap buffer overflow in SQLite FTS5 rowid list merging CVSS 4.0HIGH 8.5
  • TI-2025-43154 An information disclosure issue in the zipfileInflate function in the zipfile extension… CVSS 3.1HIGH 7.5
  • TI-2025-06334 Integer Truncation on SQLite CVSS 4.0HIGH 7.2
  • TI-2022-16180 SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if… CVSS 3.1HIGH 7.5
  • TI-2021-11445 An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial… CVSS 3.1HIGH 7.5
  • TI-2019-06073 Out-of-bounds read in SQLite CVSS 3.1CRITICAL 9.8
See all 75 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences