PT-2026-25047 · Sqlite · Sqlite

Published 2026-03-12 · Updated 2026-04-18 · CVE-2025-70873

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SQLite versions 3.51.1 and earlier

Description An issue exists where a crafted ZIP file can lead to the disclosure of heap memory. The issue is present in the zipfileInflate function within the zipfile extension.

Recommendations Versions prior to 3.51.1 should be updated.

Exploit

Fix

Weakness Enumeration

CWE-244

Related Identifiers

BIT-SQLITE-2025-70873

CVE-2025-70873

ECHO-186E-750F-440B

OESA-2026-1767

OESA-2026-1768

OESA-2026-1769

OESA-2026-1770

OESA-2026-1771

OESA-2026-1772

OPENSUSE-SU-2026:10406-1

OPENSUSE-SU-2026:20513-1

RHSA-2026:7656

SUSE-SU-2026:0955-1

SUSE-SU-2026:1065-1

SUSE-SU-2026:20771-1

SUSE-SU-2026:20794-1

SUSE-SU-2026:21095-1

SUSE-SU-2026:21173-1

Affected Products

Sqlite

References · 45

• 🔥 https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2026:1065-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0955-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1771 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:21095-1 · Vendor Advisory
• https://sqlite.org/src/info/3d459f1fb1bd1b5e · Patch
• https://ubuntu.com/security/CVE-2025-70873 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1767 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20513-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:21173-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1768 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-sqlite-2025-70873 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-70873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70873 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-70873 · Vendor Advisory