CVE-2025-71316

The problem results from improper handling of Unicode to ANSI character conversion (CWE-176) by Windows C runtime. An attacker creates a specially crafted command-line argument containing Unicode characters that, when converted to ANSI, are incorrectly interpreted — instead of as file names, they are read as command-line options. Using the '-L' option, it is possible to specify a path to an arbitrary DLL library, which is then loaded by the application. This technique is related to a class of attacks based on unpredictable Unicode character transformation in Windows environments (so-called Best-Fit mapping).

An attacker can cause arbitrary code execution in the form of a malicious DLL library to be loaded, leading to violations of confidentiality, integrity, and system availability. Depending on the execution context of sqldiff.exe, process takeover or privilege escalation may be possible.

SQLite should be updated to a version released after 2025-12-26, in which the patch was introduced. Details regarding specific versions should be checked in the vendor references (sqlite.org). Additionally, it is recommended to restrict the ability to run sqldiff.exe by unprivileged users and to monitor the loading of unknown DLL libraries in Windows environments.

SQLite — sqldiff.exe tool running on Microsoft Windows platform; according to the description, the vulnerability was patched around 2025-12-26. Specific versions are indicated in the vendor references.