Integer Overflow in libspatialite Affects Geometry Handling
CVE-2026-112052
6.9MEDIUM
What is CVE-2026-112052?
The libspatialite library (up to version 5.1.0) contains an integer overflow vulnerability in the WKB point and vertex count size guard within the parsing functions, specifically in gg_wkb.c. This flaw permits attackers to supply a maliciously crafted geometry BLOB that features an excessively large point count. Such exploitation could result in out-of-bounds reads, leading to potential process crashes or heap memory corruption, particularly on 32-bit builds. Users of libspatialite are advised to review their implementations and apply necessary mitigations.
Affected Version(s)
libspatialite 0 <= 5.1.0
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology