DuckDB security advisories
3 advisories · none critical or high in 12 months · latest Nov 12, 2025
3 advisories
| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 122025 | DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or I CVE-2025-64429Medium6.5fixed in 1.4.2 | Medium6.5 | 1.4.2 |
| Jan 212025 | sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb CVE-2024-41672High7.5fixed in 1.1.0 | High7.5 | 1.1.0 |
| Jan 302024 | DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature. CVE-2024-22682Critical9.8fixed in 0.9.3.dev6 | Critical9.8 | 0.9.3.dev6 |