SQLite versions 3.44.0 through 3.49.0 before 3.49.1 contain a vulnerability in the concat_ws() SQL function where memory can be written beyond the end of a malloc-allocated buffer. This occurs due to an integer overflow when the separator argument is attacker-controlled and very large, causing insufficient memory allocation.