An information disclosure vulnerability exists in the zipfileInflate function of the SQLite zipfile extension for versions 3.51.1 and earlier. By supplying a specially crafted ZIP file, an attacker can read data from the heap memory during decompression, potentially revealing sensitive information. The weakness is categorized as CWE-244 (Information Exposure through Heap) and CWE-908 (Improper Validation of Source Data).

All installations of SQLite 3.51.1 and older are affected, regardless of vendor or product embedding the library. No vendor specific restrictions are listed. The flaw is present in the default distribution of SQLite. Any application that imports or uses the zipfileInflate routine and processes external ZIP archives is at risk.

The base CVSS score of 7.5 indicates a high confidentiality impact. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must supply a crafted ZIP file to the vulnerable function; thus, the attack requires the target application to accept or process untrusted ZIP archives. No public exploit has been documented, and remediation relies on updating the library or restricting ZIP processing.