Unauthenticated Remote Improper Handling Of Unicode Encoding in SQLite sqldiff Rates 9.8 CVSS
Last refreshed2026-10-15
Status: UPDATED
| Advisory ID: CVE-2025-71316
Key Details
CVE
CVE-2025-71316
CVSS Score / Version
9.8 (Critical) / CVSS v3.1
Updated
2026-10-15
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Prose
attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
SQLite sqldiff and Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC)
Classified as
CWE-176 (Improper Handling of Unicode Encoding)
Exploitation prediction (EPSS)
0.41% probability of exploitation in the next 30 days (33% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
SQLite
sqldiff
Siemens
RUGGEDCOM CROSSBOW Station Access Controller (SAC)
Subsystems
General OT
Sectors
Multiple
What to Know
SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26. (NVD)
What to Do
Monitor SQLite's and Siemens's web pages for any future patch releases.