CVE-2026-112048 Details
Description
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.
A vulnerability in libspatialite versions through 5.1.0 allows for uncontrolled memory allocation by failing to properly validate the polygon ring count in the WKB (Well-Known Binary) decoder. This oversight can be exploited by attackers who supply crafted geometry BLOBs, either through a SpatiaLite database or as input to the ST_GeomFromWKB function. The vulnerability leads to process crashes or heap memory corruption, particularly on 32-bit builds.
Users are advised to update to libspatialite versions after 5.1.0, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow | CISA-ADP | BundleExploitTechnical Analysis |
| https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow | [email protected] | BundleExploitTechnical Analysis |
| https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c&ci=5a5528e8d2 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-uncontrolled-memory-allocation-via-parsewkbpolygon-ring-count | [email protected] | AdvisoryPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libspatialite | <= 5.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |