CVE-2025-71316
Critical · 9.8CVSS
9.8
EPSS
0.4%
Published
Jun 4, 2026
CISA due date
—
The record
SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
- CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
- CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176
- CVE-2026-14978 HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass… CWE-176
- CVE-2026-59890 setuptools is a package that allows users to download, build, install, upgrade, and… CWE-176
- CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling… CWE-176
- CVE-2026-49401 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-176
- CVE-2026-45135 Caddy is an extensible server platform that uses TLS by default. CWE-176