Read the docs
TI-2025-43437 Aliases CVE-2025-71316GHSA-gxv8-whj6-g59f

SQLite sqldiff remote code execution via argument injection

Priority MEDIUM 48CWE-176Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00544 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed sqldiff (SQLite): 2025-12-26

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SQLitesqldiffbefore 2025-12-262025-12-26Patch availableCNA
  • sqldiff VendorSQLite Affected before 2025-12-26 Fixed in 2025-12-26 Patch available CNA

Remediation

  • Fix · CNA sqldiff (SQLite) Fixed in 2025-12-26

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-71316
  2. 2026-10-03 Alias added: GHSA-gxv8-whj6-g59f

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-82983 Heap buffer overflow in SQLite FTS5 rowid list merging CVSS 4.0HIGH 8.5
  • TI-2025-43154 An information disclosure issue in the zipfileInflate function in the zipfile extension… CVSS 3.1HIGH 7.5
  • TI-2025-06334 Integer Truncation on SQLite CVSS 4.0HIGH 7.2
  • TI-2022-16180 SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if… CVSS 3.1HIGH 7.5
  • TI-2021-11445 An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial… CVSS 3.1HIGH 7.5
  • TI-2019-06073 Out-of-bounds read in SQLite CVSS 3.1CRITICAL 9.8
See all 77 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences