CVE Explorer
CVE-2025-71316
SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1
Preserved source conflicts
No provider value was silently selected as the winner.
cvss · 2 assertions
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/metrics/0/cvssV3_1
{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/metrics/1/cvssV4_0
Affected products and versions
1 source assertion{"defaultStatus":"unknown","product":"sqldiff","vendor":"SQLite","versions":[{"lessThan":"2025-12-26","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2025-12-26"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/affected/0
Provider-owned CVSS observations
2 source assertions{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/metrics/0/cvssV3_1
{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/metrics/1/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-176","description":"CWE-176 Improper Handling of Unicode Encoding","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"name":"url","tags":["exploit"],"url":"https://i.blackhat.com/EU-24/Presentations/EU-24-Tsai-V2-WorstFit-Unveiling-Hidden-Transformers-in-Windows-ANSI.pdf"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/references/2
{"name":"url","tags":["mitigation"],"url":"https://learn.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-getcommandlinea#security-remarks"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/references/1
{"name":"url","tags":["third-party-advisory"],"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-155-01.json"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/references/3
{"name":"url","tags":["patch"],"url":"https://sqlite.org/src/file/tool/winmain.c"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/references/0
{"name":"url","tags":["vdb-entry"],"url":"https://www.cve.org/CVERecord?id=CVE-2025-71316"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:75448ea73b6d3afdc27e3daa71442dde5fbc8bd897a838d14639bbed54d183ba · sha256:4eb52ffa5e9ad5b5… · /containers/cna/references/4
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.