CVE-2025-70873CWE-244

CVE-2025-70873

High · published March 12, 2026

CVSS v3.1

7.5

EPSS

Percentile

25.2

In the wild

Unconfirmed

What it is

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00332 · 25.2th percentile
Weakness: CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')
Published: 2026-03-12T23:16Z

Affected products (1)

Product	Versions	Fixed in
sqlite/sqlite	< 3.51.1	3.51.1

References (4)

https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054 · [email protected]https://sqlite.org/forum/forumpost/761eac3c82 · [email protected]https://sqlite.org/src/info/3d459f1fb1bd1b5e · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-765416.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

EPSS history

Timeline

12 MAR 00:00Z
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory…
cvelistv5