CVE-2025-64429

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing keys from memory, the compiler may remove the memset() and leave sensitive data on the heap. By modifying the database header, an attacker could downgrade the encryption mode from GCM to CTR to bypass integrity checks. There may be a failure to check return value on call to OpenSSL `rand_bytes()`. An attacker could use public IVs to compromise the internal state of RNG and determine the randomly generated key used to encrypt temporary files, get access to cryptographic keys if they have access to process memory (e.g. through memory leak),circumvent GCM integrity checks, and/or influence the OpenSSL random number generator and DuckDB would not be able to detect a failure of the generator. Version 1.4.2 has disabled the insecure random number generator by no longer using the fallback to write to or create databases. Instead, DuckDB will now attempt to install and load the OpenSSL implementation in the `httpfs` extension. DuckDB now uses secure MbedTLS primitive to clear memory as recommended and requires explicit specification of ciphers without integrity checks like CTR on `ATTACH`. Additionally, DuckDB now checks the return code.

• CWE-327

• https://duckdb.org/2025/09/16/announcing-duckdb-140.htmlRelease Notes
• https://github.com/duckdb/duckdb/blob/029a5b87ff5b1cd22f7f9717d48cd8830d00807c/src/common/random_engine.cpp#L20Product
• https://github.com/duckdb/duckdb/pull/17275Patch
• https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hpVendor Advisory

Published

Nov 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64422Coolify is an open-source and self-hostable tool for managin…4.3
• CVE-2025-64423Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-64424Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-64425Coolify is an open-source and self-hostable tool for managin…8.1
• CVE-2025-64427ZimaOS is a fork of CasaOS, an operating system for Zima dev…6.5
• CVE-2025-64428Dataease is an open source data visualization analysis tool.…9.8
• CVE-2025-6443Mikrotik RouterOS VXLAN Source IP Improper Access Control Vu…7.2
• CVE-2025-64430Parse Server is an open source backend that can be deployed …7.5
• CVE-2025-64431Zitadel is an open source identity management platform. Vers…8.7
• CVE-2025-64432KubeVirt is a virtual machine management add-on for Kubernet…4.7
• CVE-2025-64433KubeVirt is a virtual machine management add-on for Kubernet…6.5
• CVE-2025-64434KubeVirt is a virtual machine management add-on for Kubernet…6.3