Search
Find a vulnerability
Search criteria
4 vulnerabilities by SpatiaLite
CVE-2026-112052 (GCVE-0-2026-112052)
Vulnerability from nvd – Published: 2026-10-18 12:19 – Updated: 2026-10-19 18:01
VLAI
EPSS
VEX
Title
libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
Summary
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:59 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libspatialite-wkb-geo… | third-party-advisory |
| https://www.gaia-gis.it/fossil/libspatialite/file… | technical-description |
| https://www.vulncheck.com/advisories/libspatialit… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112048-11205… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SpatiaLite | libspatialite |
Affected:
0 , ≤ 5.1.0
(custom)
|
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112052",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:59:28.478602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:01:10.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112048-112052-libspatialite-wkb-geometry-count-overflow"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.gaia-gis.it/fossil/libspatialite",
"defaultStatus": "unaffected",
"product": "libspatialite",
"repo": "https://www.gaia-gis.it/fossil/libspatialite",
"vendor": "SpatiaLite",
"versions": [
{
"lessThanOrEqual": "5.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:48.000Z",
"descriptions": [
{
"lang": "en",
"value": "libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:43.850Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow"
},
{
"tags": [
"technical-description"
],
"url": "https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c\u0026ci=5a5528e8d2"
},
{
"name": "VulnCheck Advisory: libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-integer-overflow-in-wkb-geometry-parsing"
}
],
"title": "libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112052",
"datePublished": "2026-10-18T12:19:43.850Z",
"dateReserved": "2026-10-18T11:54:34.485Z",
"dateUpdated": "2026-10-19T18:01:10.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112048 (GCVE-0-2026-112048)
Vulnerability from nvd – Published: 2026-10-18 12:19 – Updated: 2026-10-18 12:19
VLAI
EPSS
VEX
Title
libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count
Summary
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.
Severity
6.1 (Medium)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libspatialite-wkb-geo… | third-party-advisory |
| https://www.gaia-gis.it/fossil/libspatialite/file… | technical-description |
| https://www.vulncheck.com/advisories/libspatialit… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SpatiaLite | libspatialite |
Affected:
0 , ≤ 5.1.0
(custom)
|
Date Public
2026-10-17 17:52
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.gaia-gis.it/fossil/libspatialite",
"defaultStatus": "unaffected",
"product": "libspatialite",
"repo": "https://www.gaia-gis.it/fossil/libspatialite",
"vendor": "SpatiaLite",
"versions": [
{
"lessThanOrEqual": "5.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:48.000Z",
"descriptions": [
{
"lang": "en",
"value": "libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:36.940Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow"
},
{
"tags": [
"technical-description"
],
"url": "https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c\u0026ci=5a5528e8d2"
},
{
"name": "VulnCheck Advisory: libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-uncontrolled-memory-allocation-via-parsewkbpolygon-ring-count"
}
],
"title": "libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112048",
"datePublished": "2026-10-18T12:19:36.940Z",
"dateReserved": "2026-10-18T11:48:36.083Z",
"dateUpdated": "2026-10-18T12:19:36.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112052 (GCVE-0-2026-112052)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 18:01
VLAI
EPSS
VEX
Title
libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
Summary
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:59 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libspatialite-wkb-geo… | third-party-advisory |
| https://www.gaia-gis.it/fossil/libspatialite/file… | technical-description |
| https://www.vulncheck.com/advisories/libspatialit… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112048-11205… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SpatiaLite | libspatialite |
Affected:
0 , ≤ 5.1.0
(custom)
|
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112052",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:59:28.478602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:01:10.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112048-112052-libspatialite-wkb-geometry-count-overflow"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.gaia-gis.it/fossil/libspatialite",
"defaultStatus": "unaffected",
"product": "libspatialite",
"repo": "https://www.gaia-gis.it/fossil/libspatialite",
"vendor": "SpatiaLite",
"versions": [
{
"lessThanOrEqual": "5.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:48.000Z",
"descriptions": [
{
"lang": "en",
"value": "libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:43.850Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow"
},
{
"tags": [
"technical-description"
],
"url": "https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c\u0026ci=5a5528e8d2"
},
{
"name": "VulnCheck Advisory: libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-integer-overflow-in-wkb-geometry-parsing"
}
],
"title": "libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112052",
"datePublished": "2026-10-18T12:19:43.850Z",
"dateReserved": "2026-10-18T11:54:34.485Z",
"dateUpdated": "2026-10-19T18:01:10.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112048 (GCVE-0-2026-112048)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-18 12:19
VLAI
EPSS
VEX
Title
libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count
Summary
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.
Severity
6.1 (Medium)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libspatialite-wkb-geo… | third-party-advisory |
| https://www.gaia-gis.it/fossil/libspatialite/file… | technical-description |
| https://www.vulncheck.com/advisories/libspatialit… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SpatiaLite | libspatialite |
Affected:
0 , ≤ 5.1.0
(custom)
|
Date Public
2026-10-17 17:52
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.gaia-gis.it/fossil/libspatialite",
"defaultStatus": "unaffected",
"product": "libspatialite",
"repo": "https://www.gaia-gis.it/fossil/libspatialite",
"vendor": "SpatiaLite",
"versions": [
{
"lessThanOrEqual": "5.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:48.000Z",
"descriptions": [
{
"lang": "en",
"value": "libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:36.940Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow"
},
{
"tags": [
"technical-description"
],
"url": "https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c\u0026ci=5a5528e8d2"
},
{
"name": "VulnCheck Advisory: libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-uncontrolled-memory-allocation-via-parsewkbpolygon-ring-count"
}
],
"title": "libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112048",
"datePublished": "2026-10-18T12:19:36.940Z",
"dateReserved": "2026-10-18T11:48:36.083Z",
"dateUpdated": "2026-10-18T12:19:36.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}