CVE-2025-70873
Sqlite ≤ 3.51.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-70873 is a high-severity Heap Inspection (CWE-244) vulnerability in Sqlite Sqlite. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-70873 is an information disclosure vulnerability affecting the zipfileInflate function within the zipfile extension of SQLite versions 3.51.1 and earlier. By supplying a crafted ZIP file, attackers can trigger the issue to expose heap memory contents. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-244. It was published on 2026-03-12.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows disclosure of sensitive heap memory data from the affected SQLite process, potentially revealing confidential information such as keys, tokens, or other in-memory data depending on the application's usage of the zipfile extension.
Mitigation details and patches are documented in SQLite advisories, including the source code check-in at https://sqlite.org/src/info/3d459f1fb1bd1b5e, a forum discussion at https://sqlite.org/forum/forumpost/761eac3c82, and a technical gist at https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054. Security practitioners should upgrade to a patched SQLite version beyond 3.51.1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208623
Vulnerability Data
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-4 requires mechanisms that stop unintended transfer of sensitive data through shared resources such as heap memory reused after realloc.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicitly requires secure deletion of sensitive data, directly addressing improper heap clearing.
Secure SDLC processes can incorporate memory-safety requirements but do not specifically mandate heap clearing.
Mandates secure coding practices that include proper memory sanitization before release.
Secure architecture principles may reduce exposure but do not prescribe explicit heap-clearing techniques.