CVE-2024-46488

Advisory

Affected versions of sqlite-vec are vulnerable to heap-buffer overflow (CWE-125). This can result in memory corruption and application crashes when parsing specially crafted Numpy files. The vulnerability is triggered by an out-of-bounds read during token scanning in the npy_token_next function, caused by insufficient boundary checks before calling strncmp. Attackers can exploit this issue by supplying malicious Numpy files.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/VulnSphere/LLMVulnSphere/blob/main/VectorDB/sqlite-vec/OOBR_2.md
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46488