Skip to content
Fencer Intel
critical 9.8

CVE-2025-3277 json

An integer overflow can be triggered in SQLite’s `concat_ws()` function.

published last yr. modified 25d ago also BIT-sqlite-2025-3277 , EUVD-2025-15064

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.

Patch / fix

  • bitnami sqlite 3.49.1
  • Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) V5.7
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • sqlite3 Debian 14, Debian 13 3.46.1-3

debian advisories DEBIAN-CVE-2025-3277

  • sqlite3 Ubuntu 24.04 LTS 3.45.1-1ubuntu2.3

ubuntu advisories UBUNTU-CVE-2025-3277

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sqlite RHEL 10.0 3.46.1-4.el10_0
  • sqlite-libs RHEL 10.0 3.46.1-4.el10_0
  • npm RHEL 9 1:10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9
  • nodejs RHEL 9 1:22.15.0-1.module+el9.6.0+23062+9e7801b9
  • nodejs-libs RHEL 9 1:22.15.0-1.module+el9.6.0+23062+9e7801b9
  • nodejs-nodemon RHEL 9 3.0.1-1.module+el9.6.0+23062+9e7801b9
  • nodejs-full-i18n RHEL 9 1:22.15.0-1.module+el9.6.0+23062+9e7801b9
  • nodejs-packaging RHEL 9 2021.06-4.module+el9.6.0+23062+9e7801b9

red hat advisories RHSA-2025:7517RHSA-2025:7433RHSA-2025:4459

  • sqlite3 SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, SLE Micro 5.5 +19 more 3.49.1-150000.3.27.1
  • sqlite3 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 3.49.1-9.33.1

suse advisories SUSE-SU-2025:01456-2SUSE-SU-2025:01455-1SUSE-SU-2025:01456-1SUSE-SU-2025:1455-1SUSE-SU-2025:1456-1

  • npm AlmaLinux 9 1:10.9.2-1.22.15.0.1.module_el9.6.0+164+2d89b8ed
  • nodejs AlmaLinux 9 1:22.15.0-1.module_el9.6.0+164+2d89b8ed
  • nodejs-libs AlmaLinux 9 1:22.15.0-1.module_el9.6.0+164+2d89b8ed
  • nodejs-nodemon AlmaLinux 9 3.0.1-1.module_el9.5.0+139+09296491
  • nodejs-full-i18n AlmaLinux 9 1:22.15.0-1.module_el9.6.0+164+2d89b8ed
  • nodejs-packaging AlmaLinux 9 2021.06-4.module_el9.5.0+139+09296491
  • nodejs-packaging-bundler AlmaLinux 9 2021.06-4.module_el9.5.0+139+09296491
  • sqlite AlmaLinux 10 3.46.1-4.el10_0

almalinux advisories ALSA-2025:7433ALSA-2025:7517ALSA-2025:4459

  • sqlite Rocky Linux 10 3.46.1-4.el10_0
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31770+0da7192d
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31785+5534beb0
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31770+0da7192d
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31786+d18c719d
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31785+5534beb0
  • nodejs Rocky Linux 8 1:22.15.0-1.module+el8.10.0+1971+0bb08ece
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1988+437f3d23

rocky linux advisories RLSA-2025:7517RLSA-2025:7433RLSA-2025:4459

  • sqlite Alpine 3.21 3.48.0-r1
  • qt6-qtwebengine Alpine 3.24, Alpine 3.23, Alpine 3.22 6.8.2-r4

alpine advisories ALPINE-CVE-2025-3277

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2025-3277 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-3277 updated cvss 7.3

SQLite: integer overflow in SQLite

  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 22.15.0-1.module+el8.10.0+23068+28ff2340, nodejs-libs 22.15.0-1.module+el8.10.0+23068+28ff2340, nodejs-nodemon 3.0.1-1.module+el8.10.0+23068+28ff2340, npm 10.9.2-1.22.15.0.1.module+el8.10.0+23068+28ff2340, nodejs-full-i18n 22.15.0-1.module+el8.10.0+23068+28ff2340, nodejs-packaging 2021.06-4.module+el8.10.0+23068+28ff2340, +1 more
    fixed: vendor fix RHSA-2025:4459
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 22.15.0-1.module+el9.6.0+23062+9e7801b9, nodejs-libs 22.15.0-1.module+el9.6.0+23062+9e7801b9, nodejs-nodemon 3.0.1-1.module+el9.6.0+23062+9e7801b9, npm 10.9.2-1.22.15.0.1.module+el9.6.0+23062+9e7801b9, nodejs-full-i18n 22.15.0-1.module+el9.6.0+23062+9e7801b9, nodejs-packaging 2021.06-4.module+el9.6.0+23062+9e7801b9, +1 more
    fixed: vendor fix RHSA-2025:7433
  • Red Hat Enterprise Linux AppStream (v. 10) sqlite 3.46.1-4.el10_0 Red Hat Enterprise Linux BaseOS (v. 10) sqlite 3.46.1-4.el10_0, sqlite-libs 3.46.1-4.el10_0
    fixed: vendor fix RHSA-2025:7517
  • Red Hat Enterprise Linux 6 lemon, sqlite, sqlite-tcl Red Hat Enterprise Linux 7 lemon, sqlite, sqlite-tcl
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 rls, rust, cargo, lemon, clippy, sqlite, +14 more Red Hat Enterprise Linux 9 rust, cargo, clippy, sqlite, rustfmt, rust-gdb, +10 more
    not affected: component not present
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-141-03 updated cvss 9.8

ABB B&R Automation Studio

  • ABB B&R Automation Studio <6.5
    affected: vendor fix, mitigation
  • ABB B&R Automation Studio 6.5
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-226-08 updated cvss 8.3

Siemens RUGGEDCOM CROSSBOW Station Access Controller

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

1.25% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami sqlite
>=3.44.0, <3.49.1
3.49.1

Affected products

  • SQLite sqlite
  • Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.