CVE-2025-29088

In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

It was discovered that SQLite incorrectly handled the concat_ws function. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, and Ubuntu 24.10. It was discovered that SQLite incorrectly handled certain argument values to sqlite3_db_config. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.