CVE-2025-71316
SQLite’s sqldiff.exe can be tricked into loading an arbitrary DLL by using the –L option with a crafted command line. This allows an attacker to run malicious code on the system. The issue has been fixed in releases from December 2025.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
SQLite’s sqldiff.exe utility on Windows systems that use the –L option.
Real-world impact
An attacker could load a malicious DLL and execute arbitrary code, potentially taking control of the affected machine.
Why this severity
The CVSS score of 9.2 reflects the high impact of arbitrary code execution, the lack of authentication or user interaction required, and the high confidentiality, integrity, and availability impact.
What to do about it
- 01Upgrade SQLite to a version released on or after 2025-12-26.
NVD description indicates the vulnerability was fixed on or around 2025-12-26.
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.