{"id":"CVE-2026-112052","title":"libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing","summary":"libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BL…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-190"],"vendor":"SpatiaLite","product":"libspatialite","affected":["libspatialite <= 5.1.0"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T12:19:43.850Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112052","references":[{"url":"https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow"},{"url":"https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c&ci=5a5528e8d2"},{"url":"https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-integer-overflow-in-wkb-geometry-parsing","label":"VulnCheck Advisory: libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T12:41:54.061Z","slug":"CVE-2026-112052","body":"## Overview\n\nlibspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.\n\n## Affected\n\n- `libspatialite <= 5.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}