An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://sqlite.org/src/info/3d459f1fb1bd1b5e Issue Tracking, Patch
Vendor advisories in the News 1
- Siemens RUGGEDCOM CROSSBOW Station Access Controller CISA ICS Advisories · 2026-10-22
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 1
Change history 1
- First seenCVSS 7.5 · sqliteNVD modified 2026-10-15 02:18
Affected (CPE criteria) 1
cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
References 4
- https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054 Exploit, Third Party Advisory
- https://sqlite.org/forum/forumpost/761eac3c82 Issue Tracking
- https://sqlite.org/src/info/3d459f1fb1bd1b5e Issue Tracking, Patch
- https://cert-portal.siemens.com/productcert/html/ssa-765416.html