Uncontrolled Memory Allocation in libspatialite Affects Various Applications
CVE-2026-112048

6.9MEDIUM

Key Information:

Vendor

Spatialite

Status
Libspatialite
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112048?

The libspatialite library versions up to 5.1.0 are vulnerable to a serious issue that occurs due to improper validation of the polygon ring count in the ParseWkbPolygon function. This flaw allows attackers to exploit crafted geometry BLOBs, leading to uncontrolled interior ring allocations. Consequently, it can result in process crashes or heap memory corruption, especially in 32-bit builds. This vulnerability poses a significant risk to applications utilizing spatial databases, necessitating prompt patching and code reviews to mitigate potential exploits.

Affected Version(s)

libspatialite 0 <= 5.1.0

References

https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-co...
third-party-advisory
https://www.gaia-gis.it/fossil/libspatialite/file?name=sr...
technical-description
https://www.vulncheck.com/advisories/libspatialite-throug...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.