---
id: CVE-2025-3277
title: An integer overflow can be triggered in SQLite’s `concat_ws()` function
summary: >-
  An integer overflow can be triggered in SQLite’s `concat_ws()` function. The
  resulting, truncated integer is then used to allocate a buffer. When SQLite
  then writes the resulting string to the buffer, it uses the original,
  untruncated si…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-122
  - CWE-190
vendor: sqlite
product: sqlite
affected:
  - 'sqlite >= 3.44.0, < 3.49.1'
patched:
  - sqlite 3.49.1
published: '2025-04-14'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:18:04.643'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-3277'
references:
  - url: 'https://sqlite.org/src/info/498e3f1cf57f164f'
    label: cve-coordination@google.com
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-994087.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00828
epssPercentile: 0.56564
ingestedAt: '2026-10-15T03:30:12.810Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-04-14T17:15:26.733637Z'
scores:
  nvd: 9.8
  cna: 6.9
---

## Overview

An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.

## Affected

- `sqlite >= 3.44.0, < 3.49.1`

## Remediation

Upgrade past the affected range:

- `sqlite 3.49.1`