CVE-2025-70873: An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

Overview

Severity

High (CVSS 7.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploit Status

Not Exploited

Patch Tuesday

2026-Sep

Released

2026-09-08

Last Updated

2026-09-08

EPSS Score

0.33% (percentile: 24.9%)

Affected Products (6)

Open Source Software

• azl3 sqlite 3.44.0-2 on Azure Linux 3.0

Developer Tools

• Microsoft Visual Studio 2026 version 18.9
• Microsoft Visual Studio 2022 version 17.14
• Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

Mariner

• cbl2 sqlite 3.39.2-4 on CBL Mariner 2.0

Security Updates (4)

• Release Notes
• Release Notes
• Release Notes
• Release Notes

Revision History

• 2026-09-08: Information published.
• 2026-04-18: Information published.
• 2026-04-24: Information published.
• 2026-09-08: Affected software updated with new package information.