CVE-2025-70873
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Mar 12, 2026
CISA due date
—
The record
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.2 | sqlite3 | 0 | 3.51.3-150000.3.39.1 |
| SUSE:Linux Enterprise Micro 5.3 | sqlite3 | 0 | 3.51.3-150000.3.39.1 |
| SUSE:Linux Enterprise Micro 5.4 | sqlite3 | 0 | 3.51.3-150000.3.39.1 |
| SUSE:Linux Enterprise Micro 5.5 | sqlite3 | 0 | 3.51.3-150000.3.39.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | sqlite3 | 0 | 3.51.3-150000.3.39.1 |
| openSUSE:Leap 15.6 | sqlite3 | 0 | 3.51.3-150000.3.39.1 |
| openSUSE:Leap 16.0 | sqlite3 | 0 | 3.51.3-160000.1.1 |
| openSUSE:Tumbleweed | sqlite3 | 0 | 3.51.3-1.1 |
Related vulnerabilities
- CVE-2025-6965 There exists a vulnerability in SQLite versions before 3.50.2 where the number of… Also affects sqlite3
- CVE-2022-46908 SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script… Also affects sqlite3
- CVE-2022-35737 SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if… Also affects sqlite3
- CVE-2026-11822 SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text… Also affects sqlite3
- CVE-2026-11824 SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5… Also affects sqlite3
- CVE-2026-20039 A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security… CWE-244
- CVE-2025-33101 IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information… CWE-244