CVE-2026-112052
mediumlibspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_w…
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow disclosure@vulncheck.com
- https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c&ci=5a5528e8d2 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-integer-overflow-in-wkb-g... disclosure@vulncheck.com
- https://hackmd.io/@haindpwn/cve-2026-112048-112052-libspatialite-wkb-geometry-count-overfl... 134c704f-9b21-4f2e-91b3-4a467353bcc0