{"action":"Upgrade duckdb to 1.4.2 or later.","affected":[{"fixed":"1.4.2","introduced":"1.4.0"}],"component":"duckdb","cve_ids":["CVE-2025-64429"],"ecosystem":"PyPI","epss":0.00118,"exploited":false,"fixed_versions":["1.4.2"],"ghsa_id":"GHSA-vmp8-hg63-v2hp","id":"tcs_01M5KGNNB0F9P3GF6KPW16V2ES","modified_at":"2026-05-20T09:18:59.601738Z","published_at":"2025-11-12T22:15:49.813Z","references":["https://osv.dev/vulnerability/PYSEC-2025-112","https://github.com/duckdb/duckdb/blob/029a5b87ff5b1cd22f7f9717d48cd8830d00807c/src/common/random_engine.cpp#L20","https://duckdb.org/2025/09/16/announcing-duckdb-140.html","https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp","https://github.com/duckdb/duckdb/pull/17275"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2025-112","url":"https://osv.dev/vulnerability/PYSEC-2025-112"}],"summary":"DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The Duc"}