What’s Vulnerable › Vulnerabilities

CVE-2025-70873

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-12 · updated 2026-10-15
• Weakness: CWE-244

Description

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

Affected products

• SQLite: before 3.51.1 — fixed in 3.51.1

How to fix

Upgrade to a fixed version: SQLite 3.51.1. Check the vendor advisory for mitigations.

References

• https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054
• https://sqlite.org/forum/forumpost/761eac3c82
• https://sqlite.org/src/info/3d459f1fb1bd1b5e
• https://cert-portal.siemens.com/productcert/html/ssa-765416.html

Get alerted when CVE-2025-70873 or the next vulnerability affects your stack