Junglewise Threat Intelligence

CVE-2025-71316: SQLite sqldiff.exe arbitrary DLL loading via Unicode conversion error

CVE-2025-71316 · Severity: high · CVSS 7.8 · Published 2026-06-04

Executive brief

A vulnerability in the SQLite 'sqldiff' utility on Windows allows an attacker to trick the program into loading malicious code. By using specially crafted characters in a command, an attacker can bypass security checks because the system incorrectly translates those characters. This could allow a local user to gain unauthorized control over the system or access sensitive data.

Technical details

The vulnerability is a CWE-176 (Improper Handling of Unicode Encoding) issue within the 'sqldiff.exe' tool on Windows. It stems from the use of the Microsoft Windows C runtime (specifically GetCommandLineA) which performs lossy conversion of Unicode characters to the ANSI codepage. An attacker can provide a crafted command-line string where Unicode characters (such as U+2010) are converted to ASCII characters (such as the '-' hyphen). This allows an attacker to inject the '-L' command-line option, which is used to load arbitrary DLLs, by making a file argument appear as a command option. The issue was addressed in late December 2025.

Affected products

  • SQLite sqldiff.exe Fixed on or around 2025-12-26

Timeline

  • 2025-12-26: patched: Fixed on or around this date.
  • 2026-06-04: disclosed: CVE published.

References