CVE-2025-70873
Published: 12 March 2026
Summary
CVE-2025-70873 is a high-severity Heap Inspection (CWE-244) vulnerability in Sqlite Sqlite. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated info disclosure via crafted input directly enables exploitation of public-facing SQLite-based applications (T1190) and extraction of sensitive in-memory data from the local system (T1005).
NVD Description
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
Deeper analysisAI
CVE-2025-70873 is an information disclosure vulnerability affecting the zipfileInflate function within the zipfile extension of SQLite versions 3.51.1 and earlier. By supplying a crafted ZIP file, attackers can trigger the issue to expose heap memory contents. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-244. It was published on 2026-03-12.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows disclosure of sensitive heap memory data from the affected SQLite process, potentially revealing confidential information such as keys, tokens, or other in-memory data depending on the application's usage of the zipfile extension.
Mitigation details and patches are documented in SQLite advisories, including the source code check-in at https://sqlite.org/src/info/3d459f1fb1bd1b5e, a forum discussion at https://sqlite.org/forum/forumpost/761eac3c82, and a technical gist at https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054. Security practitioners should upgrade to a patched SQLite version beyond 3.51.1.
Details
- CWE(s)