CVE-2026-112052

MediumCVSS 6.1

Published: 18/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. A crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, crashes the process or corrupts heap memory on 32-bit builds.

Risk Assessment

Applications processing spatial data with libspatialite can be crashed or have memory corrupted when opening a malicious database or geometry. Heap corruption is possible on 32-bit builds.

Recommendation

Update libspatialite to a version newer than 5.1.0 once available. Until then, avoid processing untrusted SpatiaLite database files and WKB data.

Other vulnerabilities in libspatialite

CVE-2026-112048Medium
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. A crafted polygon in a SpatiaLite database or ST_GeomFromWKB input crashes the process or corrupts heap memory on 32-bit builds.

Original NVD description (English source)

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS