Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-71316— SQLite sqldiff remote code execution via argument injection

Quick assessment

Affected
SQLite sqldiff
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SQLite sqldiff是SQLite开源的一个SQLite数据库差异比较工具。 SQLite sqldiff存在安全漏洞，该漏洞源于Windows C运行时转换Unicode字符为ANSI代码页时未安全处理，攻击者可通过-L选项加载任意DLL，导致命令行文件参数被误解为命令行选项。

CVSS 9.8 · Critical EPSS 0.38% · P30

Affected Version Matrix 2

VendorProduct Version RangeStatus
SQLite sqldiff < 2025-12-26 affected
2025-12-26 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-71316

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SQLite sqldiff remote code execution via argument injection
Source: CVE Program / CVE List V5
Vulnerability Description
SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
Unicode编码处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
SQLite sqldiff 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SQLite sqldiff是SQLite开源的一个SQLite数据库差异比较工具。 SQLite sqldiff存在安全漏洞，该漏洞源于Windows C运行时转换Unicode字符为ANSI代码页时未安全处理，攻击者可通过-L选项加载任意DLL，导致命令行文件参数被误解为命令行选项。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
SQLite sqldiff 0 ~ 2025-12-26 -

II. Public POCs for CVE-2025-71316

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-71316

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-71316 (1)

Vendor Advisories for CVE-2025-71316 (3)

Proof of Concept for CVE-2025-71316 (1)

IV. Related Vulnerabilities

Same vendor: SQLite
Same weakness: CWE-176

V. Comments for CVE-2025-71316

No comments yet

Leave a comment