{"id":"CVE-2026-112048","title":"libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count","summary":"libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLi…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-789"],"vendor":"SpatiaLite","product":"libspatialite","affected":["libspatialite <= 5.1.0"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T12:19:36.940Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112048","references":[{"url":"https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow"},{"url":"https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c&ci=5a5528e8d2"},{"url":"https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-uncontrolled-memory-allocation-via-parsewkbpolygon-ring-count","label":"VulnCheck Advisory: libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T12:41:54.063Z","slug":"CVE-2026-112048","body":"## Overview\n\nlibspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.\n\n## Affected\n\n- `libspatialite <= 5.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}