An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

🔗 CVE IDs covered (1)

🎯 Affected products6

• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
• Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
• Microsoft Visual Studio 2022 version 17.14
• Microsoft Visual Studio 2026 version 18.9
• azl3 sqlite 3.44.0-2 on Azure Linux 3.0
• cbl2 sqlite 3.39.2-4 on CBL Mariner 2.0

✅ Remediation

KBCBL-Mariner Releases (Security Update) — fixed build 3.44.0-3 KBRelease Notes (Security Update) — fixed build 18.9.3 KBRelease Notes (Security Update) — fixed build 17.14.40 KBRelease Notes (Security Update) — fixed build 16.11.60 KBRelease Notes (Security Update) — fixed build 15.9.83 KBCBL-Mariner Releases (Security Update) — fixed build 3.39.2-5

🔗 References (10)

• advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-70873
• referencehttps://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
• patchhttps://www.catalog.update.microsoft.com/Search.aspx?q=Visual Studio 2026 18.9.3
• referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
• patchhttps://www.catalog.update.microsoft.com/Search.aspx?q=Visual Studio 2022 17.14.40
• referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
• patchhttps://www.catalog.update.microsoft.com/Search.aspx?q=Visual Studio 2019 16.11.60
• referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2019/release-notes
• patchhttps://www.catalog.update.microsoft.com/Search.aspx?q=Visual Studio 2017 15.9.83
• referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2017/vs2017-relnotes