CVE-2026-112048: libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or STGeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications that process attacker-controlled SpatiaLite databases, geometry BLOBs, or WKB supplied to ST_GeomFromWKB are exposed. The described heap-memory corruption impact is specifically identified for 32-bit builds, while crafted input can crash affected processes.
What must an attacker be able to do to exploit it?
An attacker needs to cause the application to parse a crafted polygon geometry BLOB, either from a SpatiaLite database or through ST_GeomFromWKB input. The attack vector is local and requires user interaction according to the supplied severity vector.
How can I determine whether an application may be affected?
Check whether it uses libspatialite version 5.1.0 or earlier and parses untrusted SpatiaLite database content or WKB polygon input. In particular, identify code paths that invoke ST_GeomFromWKB or otherwise deserialize geometry BLOBs.