{"id":"CVE-2026-112052","title":"libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing","summary":"libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BL…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-190","CWE-125"],"vendor":"SpatiaLite","product":"libspatialite","affected":["libspatialite <= 5.1.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-19T17:59:28.478602Z"},"exploitAvailable":true,"published":"2026-10-18","updated":"2026-10-19","sourceUpdated":"2026-10-19T18:01:10.776Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112052","references":[{"url":"https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow"},{"url":"https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c&ci=5a5528e8d2"},{"url":"https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-integer-overflow-in-wkb-geometry-parsing","label":"VulnCheck Advisory: libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112052.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-112052"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554779"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112052"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112052"}],"tags":["cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.00182,"epssPercentile":0.07746,"ingestedAt":"2026-10-18T12:41:54.061Z","slug":"CVE-2026-112052","body":"## Overview\n\nlibspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.\n\n## Affected\n\n- `libspatialite <= 5.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-10-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112052.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":225087,"id":"CVE-2026-112052","ts":1792435051602,"field":"exploit_available","old":"false","new":"true"}]}