CVE-2025-3277

A flaw was found in SQLite’s concat_ws() function, where an integer overflow can be triggered. The resulting truncated integer can allocate a buffer. When SQLite writes the resulting string to the buffer, it uses the original, untruncated size, and a wild heap buffer overflow size of around 4GB can occur. This issue can result in arbitrary code execution.

For Openshift, the bundled sqlite3.c does contain the affected concat_ws function, it is not included in the Rust bindings of the libsqlite3-sys crate, nor are there any indirect ways to call it. Therefore, this is dead code in this context, and Openshift is not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.