CVE-2025-70873: sqlite Heap Inspection

Vulnerability summary

CVE-2025-70873 is a high (CVSS 7.5) Heap Inspection vulnerability in sqlite. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-03-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

• CWE-244Improper Clearing of Heap Memory Before Release ('Heap Inspection')Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.