Introduction
A single miscalculation in a memory allocation routine can bring down applications that millions of people rely on. SQLite, the embedded database engine found in browsers, mobile devices, and enterprise software, has a newly disclosed vulnerability that can crash any application using version 3.50.0 with certain configuration patterns.
SQLite is a C-language library that provides a lightweight SQL database engine. It is one of the most widely deployed database engines in the world, embedded in smartphones, browsers, and IoT devices. Its reliability and small footprint have made it a foundational component of countless products and services.
Technical Information
CVE-2025-52099 is an integer overflow vulnerability in the setupLookaside function of SQLite 3.50.0. It is triggered when an application calls the sqlite3_db_config API with the SQLITE_DBCONFIG_LOOKASIDE option and attacker-controlled sz (size) and cnt (count) parameters. The cause is improper type casting in a memory allocation calculation, and the result can be a denial of service.
The relevant code looks like this:
sqlite3_int64 szAlloc = sz * (sqlite3_int64)cnt; ... nSm = (int)((szAlloc - sz * nBig) / LOOKASIDE_SMALL);
Here sz * nBig is not cast to sqlite3_int64, so if sz and nBig are large, the multiplication can overflow a 32-bit integer. That produces a wrong value for nSm, which is used to divide the lookaside buffer. When the calculation overflows, the application may allocate the wrong amount of memory, and the result is a crash or denial of service.
The vulnerability is only exploitable if an attacker can control the parameters passed to sqlite3_db_config for lookaside buffer configuration. Applications that do not expose this configuration to untrusted input are not affected.
Affected Systems and Versions
- SQLite 3.50.0 is affected
- Only systems or applications that pass untrusted input to the
sqlite3_db_configAPI withSQLITE_DBCONFIG_LOOKASIDEare vulnerable - No other versions are currently listed as affected in public sources
Vendor Security History
SQLite has had several integer overflow vulnerabilities in 2025, including:
- CVE-2025-29088 (setupLookaside in 3.49.0)
- CVE-2025-29087 (concat_ws function in 3.44.0 through 3.49.0)
The SQLite project has a reputation for responding quickly to impactful vulnerabilities, but its fixes have not always been applied consistently across all major versions.
