Description
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | No fix yet | — |
| Debian 13 | sqlite3 | No fix yet | — |
| Debian 12 | sqlite3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | sqlite +7 | 3.52.0-1.1.hum1 | RHSA-2026:7656 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | sqlite3 | 3.51.3-150000.3.39.1 | SUSE-SU-2026:1065-1 |
| SLES 12 SP5 | sqlite3 | 3.51.3-9.47.1 | SUSE-SU-2026:0955-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | sqlite3 | 3.51.3-160000.1.1 | SUSE-SU-2026:21173-1 |
| SLES 16.0 | sqlite3 | 3.51.3-160000.1.1 | SUSE-SU-2026:21173-1 |
| SLE Micro 6.2 | sqlite3 | 3.51.3-160000.1.1 | SUSE-SU-2026:21095-1 |
| SLE Micro 6.1 | sqlite3 | 3.51.3-slfo.1.1_1.1 | SUSE-SU-2026:20771-1 |
| SLE Micro 6.0 | sqlite3 | 3.51.3-1.1 | SUSE-SU-2026:20794-1 |
| SLE Micro 5.5 | sqlite3 | 3.51.3-150000.3.39.1 | SUSE-SU-2026:1065-1 |
| SLE Micro 5.4 | sqlite3 | 3.51.3-150000.3.39.1 | SUSE-SU-2026:1065-1 |
| SLE Micro 5.3 | sqlite3 | 3.51.3-150000.3.39.1 | SUSE-SU-2026:1065-1 |
| SLE Micro 5.2 | sqlite3 | 3.51.3-150000.3.39.1 | SUSE-SU-2026:1065-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sqlite3 | 3.51.3-1.1 | openSUSE-SU-2026:10406-1 |
| openSUSE Leap 16.0 | sqlite3 | 3.51.3-160000.1.1 | openSUSE-SU-2026:20513-1 |
| openSUSE Leap 15.6 | sqlite3 | 3.51.3-150000.3.39.1 | SUSE-SU-2026:1065-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | sqlite | 3.44.0-3 | — |
Advisories 17
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- ICSA-26-295-15 Siemens RUGGEDCOM CROSSBOW Station Access Controller CISA ICS & IT advisories · Oct 22, 2026
- NCSC-2026-0415 Kwetsbaarheden verholpen in Siemens-producten NCSC-NL (Netherlands) · Oct 13, 2026
- SSA-765416 SSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Siemens ProductCERT · Oct 13, 2026
- RHSA-2026:7656 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- NCSC-2026-0258 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jul 22, 2026
- WID-SEC-2026-2445 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- NCSC-2026-0200 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jun 17, 2026
- WID-SEC-2026-1942 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 16, 2026
- openSUSE-SU-2026:20513-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21173-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21095-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Apr 17, 2026
- SUSE-SU-2026:1065-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Mar 27, 2026
- SUSE-SU-2026:20794-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Mar 25, 2026
- SUSE-SU-2026:20771-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Mar 25, 2026
- SUSE-SU-2026:0955-1 Security update for sqlite3 SUSE / openSUSE Security Updates · Mar 24, 2026
- openSUSE-SU-2026:10406-1 lemon-3.51.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026