Skip to main content

Sqlite CVE-2025-70873

HIGH
Improper Clearing of Heap Memory Before Release ('Heap Inspection') (CWE-244)
2026-03-12 cve@mitre.org
Information Disclosure Sqlite
High
Disputed · 7.5 Vendor: mitre
View

Vulnerability Assessment

Weakness
CWE
CWE-244
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Improper clearing of heap data
Exploit ScenarioDerived

An attacker could exploit this vulnerability to obtain heap memory via supplying a crafted ZIP file.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

SQLite's zipfile extension contains a bug in the zipfileInflate function that leaks heap memory contents when processing specially crafted ZIP files. This affects SQLite version 3.51.1 and earlier installations that use the zipfile extension. An attacker can exploit this by providing a malicious ZIP file to read sensitive data from the application's memory, potentially exposing passwords, encryption keys, or other confidential information.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 19:57 CVSS 7.5

zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier contains a vulnerability that allows attackers to obtain heap memory via supplying a crafted ZIP file.

RemediationAI

Monitor vendor advisories for a patch.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

exists in the zipfileInflate component. An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

Know when Sqlite gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (mitre) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 3.3 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 08:30 nvd
Patch available
CVE Published
Mar 12, 2026 - 19:16 nvd
HIGH 7.5

DescriptionCVE.org

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

Executive ViewAI

Why It Matters

Organizations using the zipfileInflate function in the zipfile extension in SQLite face notable risk from CVE-2025-70873 rated CVSS 7.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Threat Intel
1
1 sources
Vendor Status
Publicly Disclosed:No
Exploited:No
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS CISA MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

68
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*

More in Sqlite

View all
CVE-2015-5895 CRITICAL POC
10.0 Sep 18

Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a
CVE-2019-8457 CRITICAL
9.8 May 30

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when hand
CVE-2022-35737 HIGH POC
7.5 Aug 03

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a

CVE-2017-10989 CRITICAL
9.8 Jul 07

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles u
CVE-2025-6965 HIGH POC
7.2 Jul 15

Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggr
CVE-2019-5018 HIGH POC
8.1 May 10

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Rated high se
CVE-2025-71316 CRITICAL POC
9.2 Jun 04

Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing t
CVE-2026-11822 HIGH POC
8.5 Jun 09

Memory corruption in SQLite versions before 3.53.2 enables attackers to crash processes, exhaust memory, or potentially

CVE-2020-13871 HIGH POC
7.5 Jun 06

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i
CVE-2020-11655 HIGH POC
7.5 Apr 09

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function
CVE-2021-36690 HIGH POC
7.5 Aug 24

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo functi
CVE-2026-87016 HIGH POC
8.1 Sep 09

OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re

Same weakness CWE-244 – Improper Clearing of Heap Memory Before Release ('Heap Inspection')

View all
CVE-2026-20349 HIGH POC
8.6
CVE-2025-26304 HIGH POC
8.2
CVE-2025-26305 HIGH POC
8.2
CVE-2026-20039 HIGH
8.6
CVE-2025-1721 HIGH
7.5
CVE-2025-36118 HIGH
7.5
CVE-2026-48025 MEDIUM
6.9
CVE-2022-20922 MEDIUM
6.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.147 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.113 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.132 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.145 Container suse/sl-micro/6.0/toolbox:13.2-9.81 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.77 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.99 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.103 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.91 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Affected
Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.2/toolbox:14.2-7.11.264 Container suse/sle-micro/base-5.5:latest Container suse/sle-micro/kvm-5.5:latest Affected
Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-EC2 Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-15
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://vuldb.com/?id.350756 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0955/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1065/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20771/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ REF https://cert-portal.siemens.com/productcert/html/ssa-765416.html REF https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054 REF https://sqlite.org/forum/forumpost/761eac3c82 REF https://sqlite.org/src/info/3d459f1fb1bd1b5e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy