SQLite sqldiff CVE-2025-71316

Exploitation requires the Windows build of sqldiff.exe (the bug is in the Microsoft C runtime ANSI conversion path, so non-Windows builds are unaffected) and a code path in which attacker-influenced strings are passed as command-line arguments to sqldiff - for example, a service, web backend, or script that calls sqldiff.exe with a user-supplied filename or database path. The attacker must also be able to place a DLL where sqldiff's '-L' loader can reach it, typically a UNC/WebDAV path the target host can resolve or a writable local directory. Limiting factors are the AT:P attack requirement (the calling environment must propagate Unicode characters into argv rather than rejecting or normalising them), the absence of CISA KEV listing, and the fact that interactive command-line use by a trusted administrator does not realistically expose this surface.

CVSS 4.0 base score 9.2 (Critical) reflects network attack vector, low complexity, no privileges, no user interaction, and high CIA impact, but the AT:P (Attack Requirements: Present) flag and the 'WorstFit' technique itself signal real-world conditions are narrower than the headline score implies. The CVSS AV:N rating is questionable for a local CLI utility - exploitation realistically requires that some upstream component (a web app, build pipeline, or wrapper script) passes attacker-influenced strings to sqldiff.exe, so a defender should treat AV as effectively 'network-adjacent' rather than directly remote. A public exploit technique is documented in the Blackhat EU 2024 'WorstFit' research, and a patch is available, but the CVE is not in CISA KEV and EPSS data was not provided, suggesting opportunistic rather than mass exploitation at this time. Priority is high for any environment that exposes sqldiff.exe to externally controlled arguments and low to moderate for users who only invoke it interactively.

An attacker submits a filename containing Unicode lookalike characters (for example, a full-width hyphen) to a web application, build pipeline, or batch script that forwards user input as a command-line argument to sqldiff.exe. When sqldiff starts, the Windows ANSI conversion Best-Fits those characters into ASCII '-L <path>', causing sqldiff to load an attacker-controlled DLL (hosted on a UNC share or dropped to a writable directory) and execute its DllMain in the context of the invoking process. The Blackhat EU 2024 'WorstFit' presentation publicly documents the underlying technique.