CVE-2025-71316

Vulnerability

SQLite's sqldiff.exe utility on Microsoft Windows does not securely handle the conversion of Unicode characters to ANSI codepages. This vulnerability affects versions of sqldiff.exe prior to the fix released around 2025-12-26. [1]

Exploitation

An attacker can exploit this vulnerability by using the -L option with sqldiff.exe and providing a crafted command line argument string. This crafted string, when misinterpreted due to the Unicode to ANSI conversion, can lead to the loading of an arbitrary DLL, effectively hijacking the command line file argument processing. [1]

Impact

Successful exploitation allows an attacker to load and execute arbitrary DLLs, leading to arbitrary code execution with the privileges of the sqldiff.exe process. This could result in a compromise of the system where sqldiff.exe is run. [1]

Mitigation

This vulnerability was fixed on or around 2025-12-26. Users should update to a version of SQLite that includes this fix. No workarounds are specified in the available references. [1]