GHSA-w35v-6xgp-6m6wMediumCVSS 6.1
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing...
🔗 CVE IDs covered (1)
📋 Description
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-112048
- https://hackmd.io/@haindpwn/libspatialite-wkb-geometry-count-overflow
- https://www.gaia-gis.it/fossil/libspatialite/file?name=src/gaiageo/gg_wkb.c&ci=5a5528e8d2
- https://www.vulncheck.com/advisories/libspatialite-through-5.1.0-uncontrolled-memory-allocation-via-parsewkbpolygon-ring-count
- https://github.com/advisories/GHSA-w35v-6xgp-6m6w