CVE-2025-29088: Integer Overflow
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3dbconfig (in the C-language API) can cause a denial of service (application crash). An sznBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.49.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-29088?
CVE-2025-29088 is classified as a denial of service vulnerability which can potentially disrupt service availability.
How do I fix CVE-2025-29088?
To remediate CVE-2025-29088, upgrade to a patched version of SQLite that addresses this vulnerability.
What systems are affected by CVE-2025-29088?
CVE-2025-29088 affects SQLite version 3.49.0 specifically.
Can CVE-2025-29088 be exploited remotely?
Yes, CVE-2025-29088 allows an attacker to exploit the vulnerability remotely to cause a denial of service.
What component is involved in CVE-2025-29088?
CVE-2025-29088 involves the SQLITE_DBCONFIG_LOOKASIDE component of SQLite.