CVE-2025-3277

What it is

An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

1.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-04-14 17:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-15 02:18 UTC Last updatedMost recent change to the record

Details

Published

2025-04-14 17:15 UTC

Last modified

2026-10-15 02:18 UTC

Exploit probability

1.3% · EPSS, next 30 days

Weakness

CWE-122

Record status

Modified

Affected

• Sqlite < 3.49.1

Attack profile CVSS 4.0 · 6.9

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

Low