In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://www.sqlite.org/cves.html Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · sqliteNVD modified 2026-10-15 02:17
Affected (CPE criteria) 1
cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
References 5
- https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a Third Party Advisory
- https://sqlite.org/releaselog/3_49_1.html Release Notes
- https://www.sqlite.org/cves.html Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-994087.html