CVE-2026-112052 SpatiaLite CVE debrief

Who should care

Defenders and administrators responsible for systems using libspatialite 5.1.0 or earlier should assess exposure and prioritize patching or verification. They should also conduct inventory checks for affected systems and verify vendor remediation status. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-112052 is a medium-severity vulnerability in libspatialite that could lead to denial of service or memory corruption. Defenders should assess exposure, prioritize patching or verification, and conduct inventory checks for affected systems.

• Potential denial of service through process crashes
• Possible memory corruption on 32-bit builds
• Requires verification of affected versions and remediation status
• Prioritization of inventory checks for affected systems

Technical summary

The libspatialite library through version 5.1.0 is vulnerable to an integer overflow in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c. This allows for out-of-bounds reads when a crafted geometry BLOB with a large point count is supplied. The vulnerability can cause the process to crash or corrupt heap memory on 32-bit builds. Defenders should assess exposure and prioritize patching or verification for systems using libspatialite 5.1.0 or earlier. The vulnerability can be triggered by supplying a crafted geometry BLOB with a large point count, such as in a SpatiaLite database file.

Defensive priority

Assess exposure and verify patching for libspatialite 5.1.0 or earlier; prioritize inventory checks for affected systems.

Recommended defensive actions

• Assess exposure and verify patching for libspatialite 5.1.0 or earlier
• Prioritize inventory checks for affected systems
• Verify vendor remediation status
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the integer overflow vulnerability in libspatialite. However, specific version remediation and exploitation details are limited. Defenders should verify patching for libspatialite 5.1.0 or earlier and conduct inventory checks for affected systems. The vulnerability allows for out-of-bounds reads when a crafted geometry BLOB with a large point count is supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.