CVE-2025-71316

Name of the Vulnerable Software and Affected Versions SQLite sqldiff.exe versions prior to 2025-12-26

Description The sqldiff.exe utility does not securely handle the conversion of Unicode characters to ANSI codepages by the Microsoft Windows C runtime. An attacker can exploit this by using the '-L' option with a specially crafted command line argument string, causing file arguments to be misinterpreted as command line options, which leads to the loading of an arbitrary DLL (Dynamic Link Library, a file containing code and data that can be used by more than one program at the same time).

Recommendations Update to the version released on or around 2025-12-26.