We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
Reserved 2025-04-04 | Published 2025-04-14 | Updated 2025-05-27 | Assigner GoogleCWE-122 Heap-based Buffer Overflow
王跃林 (Yuelin Wang)
sqlite.org/src/info/498e3f1cf57f164f
Support options
