Medium severity6.1NVD Advisory· Published Oct 18, 2026

CVE-2026-112048

Description

libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Gaia Gis/libspatialitellm-create
Range: <=5.1.0
Libspatialite/libspatialitellm-fuzzy
Range: <=5.1.0

Patches

Vulnerability mechanics

References

hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflownvd
www.gaia-gis.it/fossil/libspatialite/filenvd
www.vulncheck.com/advisories/libspatialite-through-5.1.0-uncontrolled-memory-allocation-via-parsewkbpolygon-ring-countnvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000