SQLite sqldiff.exe improperly handles Unicode to ANSI codepage conversion in the Windows C runtime, allowing crafted command line arguments with the '-L' option to be misinterpreted as command line options rather than file arguments. This flaw enables an attacker to load arbitrary DLLs, potentially leading to full system compromise. The vulnerability is identified as CWE-176 (Improper Handling of Unicode Encoding) and carries a CVSS 3.1 score of 9.8, indicating critical severity. The fix was applied on or around December 26, 2025, though no direct patch or advisory link is provided.

Successful exploitation allows an unauthenticated attacker to load arbitrary DLLs via crafted command line arguments to sqldiff.exe, potentially resulting in full system compromise affecting confidentiality, integrity, and availability.

A fix for this vulnerability was implemented around December 26, 2025. However, no official patch link or vendor advisory is provided in the available data. Users should verify with the SQLite project for the official patched version of sqldiff.exe and update accordingly. Until then, avoid using the '-L' option with untrusted input to mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.