Duckdb (Duckdb) - vulnerabilities (CVEs)

4 CVEs, 1 in the last 30 days, 68 known versions, newest CVE from 2026-10-22. Vendor: Duckdb.

CVEs of Duckdb

• CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
• CVE-2026-58139 - CVSS 6.5 (medium), 2026-08-03: The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract…
• CVE-2025-64429 - CVSS 6.9 (medium), 2025-11-12: DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few…
• CVE-2024-41672 - CVSS 7.5 (high), 2024-07-24: DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with…