CVE-2026-112048

MediumCVSS 6.1

Published: 18/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. A crafted polygon in a SpatiaLite database or ST_GeomFromWKB input crashes the process or corrupts heap memory on 32-bit builds.

Risk Assessment

Applications processing spatial data with libspatialite can be crashed or have memory corrupted when opening a malicious geometry. Heap corruption is possible on 32-bit builds.

Recommendation

Update libspatialite to a version newer than 5.1.0 once available. Until then, avoid processing untrusted SpatiaLite database files and WKB data.

Other vulnerabilities in libspatialite

CVE-2026-112052Medium
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. A crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, crashes the process or corrupts heap memory on 32-bit builds.

Original NVD description (English source)

libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS