Description
SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SQLite | sqldiff | < 2025-12-26 | 2025-12-26 |
Advisories 4
- ICSA-26-295-15 Siemens RUGGEDCOM CROSSBOW Station Access Controller CISA ICS & IT advisories · Oct 22, 2026
- NCSC-2026-0415 Kwetsbaarheden verholpen in Siemens-producten NCSC-NL (Netherlands) · Oct 13, 2026
- SSA-765416 SSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Siemens ProductCERT · Oct 13, 2026
- VA-26-155-01 SQLite sqldiff remote code execution via argument injection CISA ICS & IT advisories · Jun 4, 2026