High severity · published Mar 12, 2026
CVE-2025-70873
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a…
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Sqlite · Sqlite
before 3.51.1 · source: NVD
RC
RUGGEDCOM CROSSBOW Station Access Controller (SAC) · Siemens
before V6.0 · source: CISA
In the news
VulnerabilityCritical
Siemens RUGGEDCOM CROSSBOW Station Access Controller
View CSAF
Summary
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.
The following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller are affected:
RUGGEDCOM CROSSBOW Station Access Controller (SAC) vers:intdot/<6.0 (CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824)
CVSS
Vendor
Equipment
v3 9.8
Siemens
RUGGEDCOM CROSSBOW Station Access Controller (SAC)
4 Vulnerabilities
Numeric Truncation Error, Improper Clearing of Heap Memory Before Release ('Heap Inspection'), Improper Handling of Unicode Encoding, Heap-based Buffer Overflow
Background
Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2025-6965
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption iss...
Oct 22, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-70873
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-70873
Exploit
https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054
Issue Tracking
https://sqlite.org/forum/forumpost/761eac3c82
Issue Tracking
https://sqlite.org/src/info/3d459f1fb1bd1b5e
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-765416.html
More from Sqlite
9.8
CVE-2025-3277
An integer overflow can be triggered in SQLite’s `concat_ws()` function
9.8
CVE-2020-35527
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause
9.8
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement
9.8
CVE-2019-19646
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns
9.8
CVE-2019-19317
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly…