We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
Reserved 2025-03-11 | Published 2025-04-07 | Updated 2025-04-15 | Assigner mitreCWE-190 Integer Overflow or Wraparound
gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a
sqlite.org/releaselog/3_49_1.html
Support options
