EUVD-2025-210067
GHSA-gxv8-whj6-g59f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (cisa-cg) · only source for this CVE.
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
8DescriptionCVE.org
SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.
AnalysisAI
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing the Microsoft C runtime's Unicode-to-ANSI Best-Fit character conversion. Specially crafted Unicode characters in command-line arguments can be transformed into ASCII characters that sqldiff then parses as the '-L' option, loading an attacker-supplied DLL. Publicly available exploit research (Blackhat EU 2024 'WorstFit' presentation) demonstrates the technique, though no public exploit identified targeting sqldiff specifically and it is not listed in CISA KEV.
Technical ContextAI
sqldiff.exe is a command-line diagnostic tool shipped with SQLite that compares two database files. The root cause maps to CWE-176 (Improper Handling of Unicode Encoding), specifically the Windows GetCommandLineA / CommandLineToArgvA conversion path, which performs Best-Fit (WorstFit) mapping from Unicode codepoints into the active ANSI codepage. Characters such as full-width hyphens or other Unicode 'lookalikes' get silently transliterated into ASCII '-' and letters, so a string that was passed as a benign filename argument can be re-interpreted by the argv parser as the '-L <path>' switch that sqldiff uses to load a shared extension DLL. The affected CPE is cpe:2.3:a:sqlite:sqldiff (all versions prior to the 2025-12-26 fix in tool/winmain.c).
RemediationAI
Upgrade sqldiff.exe to a SQLite tool build dated on or after 2025-12-26 that incorporates the winmain.c fix (see https://sqlite.org/src/file/tool/winmain.c and the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-155-01.json). Where patching is delayed, avoid invoking sqldiff.exe with externally supplied or untrusted command-line arguments, and where possible run it from wrapper scripts that explicitly use the Unicode CommandLineToArgvW API or pass arguments through a sanitised allowlist; note that this requires changes in every caller of sqldiff and does not protect interactive use. As a stronger compensating control, remove sqldiff.exe from Windows hosts that do not need it, or run it under an unprivileged service account with AppLocker/WDAC rules blocking DLL loads from user-writable paths - the trade-off being that legitimate use of the '-L' shared-extension feature will break.
Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles u
Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggr
Memory corruption in SQLite versions before 3.53.2 enables attackers to crash processes, exhaust memory, or potentially
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Rated high se
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow)
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases wh
SQLite's zipfile extension contains a bug in the zipfileInflate function that leaks heap memory contents when processing
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo functi
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i
Same weakness CWE-176 – Improper Handling of Unicode Encoding
View allShare
External POC / Exploit Code
Leaving vuln.today