Duckdb
3 CVEs across 3 Duckdb products. Browse Duckdb vulnerabilities, severities, and proof-of-concept exploits.
Duckdb products with known CVEs
Duckdb CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-58139 | Medium | 6.5 | 2026-08-03 | The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract pla… |
CVE-2025-64429 | Medium | 6.5 | 2025-11-12 | DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issue… |
CVE-2025-59037 | | | 2025-09-09 | DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malwar… |
CVE-2024-41672 | High | 7.5 | 2024-07-24 | DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_e… |