EUVD-2025-210067
GHSA-gxv8-whj6-g59f
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionNVD
SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.
AnalysisAI
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing the Microsoft C runtime's Unicode-to-ANSI Best-Fit character conversion. Specially crafted Unicode characters in command-line arguments can be transformed into ASCII characters that sqldiff then parses as the '-L' option, loading an attacker-supplied DLL. Publicly available exploit research (Blackhat EU 2024 'WorstFit' presentation) demonstrates the technique, though no public exploit identified targeting sqldiff specifically and it is not listed in CISA KEV.
Technical ContextAI
sqldiff.exe is a command-line diagnostic tool shipped with SQLite that compares two database files. The root cause maps to CWE-176 (Improper Handling of Unicode Encoding), specifically the Windows GetCommandLineA / CommandLineToArgvA conversion path, which performs Best-Fit (WorstFit) mapping from Unicode codepoints into the active ANSI codepage. Characters such as full-width hyphens or other Unicode 'lookalikes' get silently transliterated into ASCII '-' and letters, so a string that was passed as a benign filename argument can be re-interpreted by the argv parser as the '-L <path>' switch that sqldiff uses to load a shared extension DLL. The affected CPE is cpe:2.3:a:sqlite:sqldiff (all versions prior to the 2025-12-26 fix in tool/winmain.c).
RemediationAI
Upgrade sqldiff.exe to a SQLite tool build dated on or after 2025-12-26 that incorporates the winmain.c fix (see https://sqlite.org/src/file/tool/winmain.c and the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-155-01.json). Where patching is delayed, avoid invoking sqldiff.exe with externally supplied or untrusted command-line arguments, and where possible run it from wrapper scripts that explicitly use the Unicode CommandLineToArgvW API or pass arguments through a sanitised allowlist; note that this requires changes in every caller of sqldiff and does not protect interactive use. As a stronger compensating control, remove sqldiff.exe from Windows hosts that do not need it, or run it under an unprivileged service account with AppLocker/WDAC rules blocking DLL loads from user-writable paths - the trade-off being that legitimate use of the '-L' shared-extension feature will break.
More from same product – last 7 days
Privilege elevation in Microsoft Azure HorizonDB allows remote unauthenticated attackers to bypass authentication via id
Arbitrary file read and remote code execution in Vitest versions prior to 4.1.0 allow remote unauthenticated attackers t
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised t
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised t
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised t
Share
External POC / Exploit Code
Leaving vuln.today