CVE-2026-112052 Details
Description
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.
A vulnerability exists in libspatialite versions through 5.1.0, specifically within the WKB (Well-Known Binary) geometry parsing. The issue arises from an integer overflow in the point and vertex count size guard of the 'ParseWkbLine' function and related parsers in 'gg_wkb.c'. This flaw allows for out-of-bounds reads, as attackers can supply a crafted geometry BLOB with a large point count, such as in a SpatiaLite database file. The exploitation of this vulnerability can lead to process crashes or heap memory corruption, particularly on 32-bit builds.
Users are advised to update to a version of libspatialite that addresses this vulnerability. The specific fix involves adding proper bounds checks to the WKB parsers to prevent integer overflows and out-of-bounds accesses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/cve-2026-112048-112052-libspatialite-wkb-geometry-count-overflow | CISA-ADP | BundleExploitTechnical Analysis |
| https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow | [email protected] | BundleExploitTechnical Analysis |
| https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c&ci=5a5528e8d2 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-integer-overflow-in-wkb-geometry-parsing | [email protected] | AdvisoryPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libspatialite | <= 5.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |