CVE-2025-29088

Published: 4/10/2025 Last updated: 4/14/2025 Reserved: 3/11/2025

In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

CNA assigner: mitre (8254265b-2729-46b6-b9e3-3dfca2d5bfca) Requested by: n/a

Metrics

Version	Score	Severity	Vector String
3.1	5.6	Medium	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Opam packages affected (4)

conf-mingw-w64-sqlite3-i686 conf-mingw-w64-sqlite3-x86_64 conf-sqlite3 lemonade-sqlite

Products affected (1)

Product	Vendor	Version
SQLite	SQLite	QDU1210

References (5)

https://www.sqlite.org/cves.html
https://sqlite.org/forum/forumpost/48f365daec
https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4
https://gist.github.com/ylwango613/d3883fb9f6ba8a78086356779ce88248
https://sqlite.org/releaselog/3_49_1.html