CVE-2025-70873 is an information disclosure vulnerability in SQLite's zipfile extension, specifically in the zipfileInflate function. A remote attacker can exploit this by providing a crafted ZIP file, causing the application to disclose sensitive heap memory contents due to use of uninitialized resources (CWE-908). Red Hat has issued an advisory (RHSA-2026:7656) addressing this flaw with updated RPM packages for various SQLite components. The vulnerability has a low severity rating by Red Hat, with no known active exploitation. The CVSS score varies between Red Hat (3.3) and other sources (7.5) due to differing assessment contexts, but Red Hat's rating is authoritative for its products.

Successful exploitation could lead to disclosure of sensitive heap memory information, potentially exposing confidential data. There is no impact on integrity or availability. The vulnerability requires a crafted ZIP file to trigger and involves reading uninitialized memory. No known exploits are currently active in the wild.

Red Hat has released updated RPM packages containing fixes for this vulnerability. Users should apply these official updates to affected products. No additional mitigations are specified or required beyond applying the vendor-provided patches. Patch status is not explicitly stated in the advisory text provided, so users should consult the Red Hat advisory RHSA-2026:7656 for the latest remediation guidance.