Heap Buffer Overflow in SQLite `concat_ws()` Function

CVE-2025-3277

What is CVE-2025-3277?

A vulnerability in SQLite's concat_ws() function allows for an integer overflow, which can be exploited to allocate an insufficient buffer size. When SQLite attempts to write to this buffer, it uses the original size, leading to a wild heap buffer overflow scenario. This overflow can be manipulated to execute arbitrary code, posing serious security risks for applications utilizing vulnerable SQLite versions.

References