duckdb vulnerabilities

Products

• duckdb/duckdb 4
• @duckdb/duckdb-wasm 1
• @duckdb/node-api 1
• @duckdb/node-bindings 1
• duckdb-node 1

Latest duckdb CVEs

Newest publication first

1. CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder

   Published 2026-10-22

   Critical·CVSS 9.2 EPSS 82.6% CISA KEV added 2026-10-27 Exploited in the wild PoC

   A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,...

2. CVE-2026-58139 DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure

   Published 2026-08-03

   Medium·CVSS 6.0 EPSS 0.51%

   The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circum...

3. CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

   Published 2025-11-12

   Medium·CVSS 6.9 EPSS 0.12%

   DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cry...

4. CVE-2025-59037 DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

   Published 2025-09-09

   High·CVSS 8.6 EPSS 0.39%

   DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included mali...

5. CVE-2024-41672 DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled

   Published 2024-07-24

   High·CVSS 7.5 EPSS 0.81%

   DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniff_csv, even with enable_external_access=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be d...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.