CVE-2025-29087

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

The following products are affected by CVE-2025-29087 vulnerability.

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-29087.

URL	Resource
https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a
https://nvd.nist.gov/vuln/detail/CVE-2025-29087
https://sqlite.org/releaselog/3_49_1.html
https://www.cve.org/CVERecord?id=CVE-2025-29087
https://www.sqlite.org/cves.html