SQLite sqldiff.exe improperly handles Unicode encoding conversions performed by the Microsoft Windows C runtime, specifically when using the '-L' option. This flaw allows crafted command line arguments to be misinterpreted as command line options, enabling an attacker with local privileges to load arbitrary DLLs. The vulnerability is categorized under CWE-176 (Improper Handling of Unicode Encoding). It affects the sqldiff tool and was addressed by a fix released around December 26, 2025. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with local access to load arbitrary DLLs via crafted command line arguments, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects the sqldiff.exe tool in SQLite and can be triggered by misuse of the '-L' option. There are no reports of known exploits in the wild.

A fix for this vulnerability was implemented around December 26, 2025. Although no direct patch link or vendor advisory is provided, users should update sqldiff.exe to the version released after this date to ensure the vulnerability is addressed. Until confirmed otherwise by the vendor, patch status should be verified through official SQLite channels. No additional mitigations are specified.