CVE-2025-70873 Information disclosure in n/a

High 7.5 Published 12 Mar 2026 Updated 15 Oct 2026

Attackers can read heap memory by supplying a crafted ZIP file to the SQLite zipfile extension, potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-70873?

CVE-2025-70873 is a high-severity vulnerability in Sqlite Sqlite, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

Weakness: CWE-244

Which versions are affected by CVE-2025-70873?

1 open source package ship an affected version, including sqlite. It affects 1 product.

Package	Affected	Fixed in
`sqlite` Bitnami	All versions	`3.51.1`

Linux distribution packages (9)

`sqlite` Red Hat:hummingbird:1	All versions	`0:3.52.0-1.1.hum1`
`sqlite-analyzer` Red Hat:hummingbird:1	All versions	`0:3.52.0-1.1.hum1`
`sqlite-debug` Red Hat:hummingbird:1	All versions	`0:3.52.0-1.1.hum1`
`sqlite-devel` Red Hat:hummingbird:1	All versions	`0:3.52.0-1.1.hum1`
`sqlite-doc` Red Hat:hummingbird:1	All versions	`0:3.52.0-1.1.hum1`
`sqlite-libs` Red Hat:hummingbird:1	All versions	`0:3.52.0-1.1.hum1`
`sqlite-tcl` Red Hat:hummingbird:1	All versions	`0:3.52.0-1.1.hum1`
`sqlite-tools` Red Hat:hummingbird:1	All versions	`0:3.52.0-1.1.hum1`
`sqlite3` openSUSE:Tumbleweed	All versions	`3.51.3-1.1`

Products include Sqlite Sqlite.

How do I fix CVE-2025-70873?

Upgrade sqlite to 3.51.1 or later.

Is CVE-2025-70873 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-70873 exists.

All Sqlite Sqlite vulnerabilities

Sources

Also known as AZL-83006, BIT-sqlite-2025-70873, DEBIAN-CVE-2025-70873, ECHO-186e-750f-440b, GHSA-p36r-6g67-869c, MGASA-2026-0195 and 12 more.