CVE-2025-29088 MEDIUM

CVE-2025-29088

Vendor Sqlite
Product SQLite
Weakness CWE-190
Published April 10, 2025
Last update August 26, 2025
View on NVD All CVEs

CVSS base score

5.6/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

Key dates

02Disclosure timeline

April 10, 2025 CVE published
August 26, 2025 Record updated