CVE-2025-29088: Integer Overflow
Published Apr 10, 2025
·Updated
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3dbconfig (in the C-language API) can cause a denial of service (application crash). An sznBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Affected Software
2 affected components
SQLite SQLite>=3.49.0<3.49.1
SQLite SQLite=3.49.0
Remediation
Event History
Apr 10, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 13, 57623
Event
via MITRE·08:39 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-29088?
CVE-2025-29088 is classified as a denial of service vulnerability which can potentially disrupt service availability.
2
How do I fix CVE-2025-29088?
To remediate CVE-2025-29088, upgrade to a patched version of SQLite that addresses this vulnerability.
3
What systems are affected by CVE-2025-29088?
CVE-2025-29088 affects SQLite version 3.49.0 specifically.
4
Can CVE-2025-29088 be exploited remotely?
Yes, CVE-2025-29088 allows an attacker to exploit the vulnerability remotely to cause a denial of service.
5
What component is involved in CVE-2025-29088?
CVE-2025-29088 involves the SQLITE_DBCONFIG_LOOKASIDE component of SQLite.