CVE-2025-70873High· 7.5▾ TwilightAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
sqlite < 3.51.1Upgrade past the affected range:
sqlite 3.51.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-11822High· 7.8SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with mal…
CVE-2026-11824High· 7.8SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation …
CVE-2025-6965High· 7.7There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available
CVE-2025-29088Medium· 5.6In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash)
CVE-2025-3277Critical· 9.8An integer overflow can be triggered in SQLite’s `concat_ws()` function
CVE-2025-29087Low· 3.2In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer