Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

SQLite zip handling can expose memory contents

CVE-2025-70873 · published 7 months ago
Summary

SQLite versions up to 3.51.1 may leak internal memory when processing a specially crafted ZIP file. An attacker who can supply such a file could see data that should remain private. Update SQLite to the latest patched release to stop this behavior.

What to do
  • Update alpine sqlite to version 3.48.0-r40072.
  • Update alpine sqlite to version 3.49.2-r10071.
  • Update alpine rootio-sqlite to version 3.49.2-r10071.
  • Update alpine rootio-sqlite to version 3.48.0-r40072.
  • Update alpine sqlite to version 3.49.2-r10073.
  • Update alpine rootio-sqlite to version 3.49.2-r10073.
  • Update sqlite to version 3.41.2-r30077.
  • Update rootio-sqlite to version 3.41.2-r30077.
  • Update sqlite to version 3.49.2-r10074.
  • Update rootio-sqlite to version 3.49.2-r10074.
  • Update sqlite to version 3.45.3-r30072.
  • Update rootio-sqlite to version 3.45.3-r30072.
  • Update sqlite to version 3.41.2-r40078.
  • Update rootio-sqlite to version 3.41.2-r40078.
  • Update sqlite to version 3.48.0-r40073.
  • Update rootio-sqlite to version 3.48.0-r40073.
  • Update sqlite to version 3.44.2-r20073.
  • Update rootio-sqlite to version 3.44.2-r20073.
  • Update sqlite sqlite to version 3.51.1 or later.
Affected software
Ecosystem VendorProductAffected versions
– sqlite sqlite < 3.51.1
cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
Root:Alpine:3.21 alpine sqlite < 3.48.0-r40072
Fix: upgrade to 3.48.0-r40072
Root:Alpine:3.22 alpine sqlite < 3.49.2-r10071
< 3.49.2-r10073
Fix: upgrade to 3.49.2-r10071
Root:Alpine:3.22 alpine rootio-sqlite < 3.49.2-r10071
< 3.49.2-r10073
Fix: upgrade to 3.49.2-r10071
Debian:11 debian sqlite3 All versions
Debian:12 debian sqlite3 All versions
Debian:13 debian sqlite3 All versions
Debian:14 debian sqlite3 All versions
Root:Alpine:3.21 alpine rootio-sqlite < 3.48.0-r40072
Fix: upgrade to 3.48.0-r40072
Root:Alpine:3.18 – sqlite < 3.41.2-r30077
< 3.41.2-r40078
Fix: upgrade to 3.41.2-r30077
Root:Alpine:3.18 – rootio-sqlite < 3.41.2-r30077
< 3.41.2-r40078
Fix: upgrade to 3.41.2-r30077
Root:Alpine:3.22 – sqlite < 3.49.2-r10074
Fix: upgrade to 3.49.2-r10074
Root:Alpine:3.22 – rootio-sqlite < 3.49.2-r10074
Fix: upgrade to 3.49.2-r10074
Root:Alpine:3.20 – sqlite < 3.45.3-r30072
Fix: upgrade to 3.45.3-r30072
Root:Alpine:3.20 – rootio-sqlite < 3.45.3-r30072
Fix: upgrade to 3.45.3-r30072
Root:Alpine:3.21 – sqlite < 3.48.0-r40073
Fix: upgrade to 3.48.0-r40073
Root:Alpine:3.21 – rootio-sqlite < 3.48.0-r40073
Fix: upgrade to 3.48.0-r40073
Root:Alpine:3.19 – sqlite < 3.44.2-r20073
Fix: upgrade to 3.44.2-r20073
Root:Alpine:3.19 – rootio-sqlite < 3.44.2-r20073
Fix: upgrade to 3.44.2-r20073
Original advisory text
CVE-2025-70873 in sqlite - Patched by Root
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-244Improper Clearing of Heap Memory Before Release ('Heap Inspection')
Timeline
Published12 Mar 2026
Updated4 Nov 2026
First seen12 Mar 2026
Sources
BELL-CVE-2025-70873 · OSV
CVE-2025-70873 · NVD
DEBIAN-CVE-2025-70873 · OSV
ROOT-OS-ALPINE-321-CVE-2025-70873 · OSV
ROOT-OS-ALPINE-322-CVE-2025-70873 · OSV
ROOT-OS-ALPINE-318-CVE-2025-70873 · OSV
ROOT-OS-ALPINE-320-CVE-2025-70873 · OSV
ROOT-OS-ALPINE-319-CVE-2025-70873 · OSV
CVE-2025-70873 · MITRE
CVE-2025-70873 · OSV
Track software like this
Free during beta