SQLite sqldiff.exe fails to handle Microsoft Windows C runtime Unicode‑to‑ANSI conversions, enabling an attacker to pass a crafted '-L' argument that causes a chosen DLL to be loaded. This flaw lets the attacker execute arbitrary code with the privileges of the user running sqldiff. The vulnerability is a classic CWE‑176 (Command Injection) and can compromise confidentiality, integrity, and availability of the affected system.

Windows installations of SQLite’s sqldiff utility that have not applied the bug fix released around 2025‑12‑26. All pre‑fix versions are vulnerable.

The CVSS score of 9.2 indicates high severity, but the EPSS score is not available, so actual exploitation probability is uncertain. Because the flaw requires passing a specially crafted command line, the most likely attack vector is a local attacker or automated attacker that can invoke sqldiff with arbitrary arguments. The flaw is not listed in the CISA KEV catalog, suggesting no documented large‑scale exploitation yet.