CVE-2025-3277 is a critical (CVSS 9.8) integer overflow in SQLite's concat_ws() function. A truncated size is used to allocate a buffer, but the write uses the original size, causing a heap overflow of about 4GB that may allow code execution. SQLite fixed it in a source check-in. Update SQLite and find bundled copies.
What's affected
SQLite builds that contain the concat_ws() function and do not include the fix. The record does not list affected or fixed release numbers. The project's fix is check-in 498e3f1cf57f164f, dated 16 February 2025, with the message that it adds a typecast to avoid 32-bit integer overflow in concat_ws() with enormous separator values and many arguments.
Check SQLite's release notes and your distribution's advisory to map that check-in to a release you can install. The record also links two Siemens ProductCERT advisories, which suggests that products which embed SQLite are tracking it as well.
Exposure depends on who can run SQL against your SQLite. In a typical app, the SQL is written by developers and values are bound. The risky cases are applications that let outside users supply SQL or very large inputs that reach concat_ws().
How to check if you're exposed
Find the SQLite version the command line tool reports, and the version your Python runtime links against:
sqlite3 -version
python3 -c "import sqlite3; print(sqlite3.sqlite_version)"
Those only show the system copies. Many applications bundle their own SQLite, in language packages, browsers, mobile apps, firmware and container images. A software bill of materials or a dependency scan is the practical way to find them.
For application code, search for places where user supplied text can become SQL, or where concat_ws() is called on user controlled values.
What to do now
- Update SQLite to a release that includes check-in 498e3f1cf57f164f, using your distribution or vendor advisory to pick the version.
- Rebuild applications and container images that bundle their own SQLite, and redeploy them.
- Make sure no code path lets untrusted users submit SQL text to SQLite.
- Cap the size of strings and the number of arguments that can reach concat_ws() from user input.
- Track vendor advisories for products that embed SQLite, such as the Siemens notices linked in the record.
Why it matters
The causes are CWE-190 (Integer Overflow or Wraparound) and CWE-122 (Heap-based Buffer Overflow). The function computes a size in a 32-bit integer, the value truncates, and a buffer is allocated at the smaller size. The write then uses the real size and runs far past the end.
SQLite is everywhere, which is why a flaw in a single string function earns a 9.8. The score assumes network reachability, which holds only if your application exposes SQL to outsiders. Your own risk can be much lower, and the only way to know is to know where SQLite lives in your estate.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
The hard part with SQLite is finding every copy. This demo shows how a dependency inventory lists embedded components across a project.
Click through it at your own pace, or open it full screen.
Quick check
Does every application using SQLite need an emergency patch?
No. Exposure depends on whether untrusted users can reach concat_ws() with crafted values, for example through SQL they supply. Still, update on your normal schedule, and sooner if your application accepts outside SQL.
Sources
- CVE-2025-3277 record on Safeguard Gold
- SQLite check-in 498e3f1cf57f164f
- Siemens ProductCERT SSA-398330
- Siemens ProductCERT SSA-994087
Last reviewed: 18 October 2026.
