CVE-2025-29088CWE-190

CVE-2025-29088

Medium · published April 10, 2025

CVSS v3.1
5.6
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00217 · 11.5th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2025-04-10T18:15Z
Affected products (1)
ProductVersionsFixed in
sqlite/sqliteall versions—
References (7)
https://gist.github.com/ylwango613/d3883fb9f6ba8a78086356779ce88248 · [email protected]https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4 · [email protected]https://sqlite.org/forum/forumpost/48f365daec · [email protected]https://sqlite.org/releaselog/3_49_1.html · [email protected]https://www.sqlite.org/cves.html · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-994087.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 10 APR 00:00Z
    In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash)
    cvelistv5